Splunk Search

How to search csv for values in a lookup table?

akke
Explorer

I have a large csv with lots of columns and a lookup table below

payload
*.exe
*.zip
*.7z

How do I search all fields for values in my lookup table? For example I want to look for values like "badfile.exe".

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Read the lookup file in a subsearch and use the format command to help build the main search.

index=foo [|inputlookup payload.csv | fields payload | format]

will expand into the search index=foo (payload=*.exe OR payload=*.zip OR payload=*.7z)

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...