I need to find various information (counts, last and first event received time, etc) on indexes listed in a CSV file. There will be a time when index names will be added and hence, I don't want to hardcode my search with index names. I want to keep them in CSV so its easy to update.
Hi,
you can use a subsearch:
[| inputlookup myindexes.csv | table index] | rest of your search
In this example, imagine there is a csv file with a column "index" and in this column you list all your indexes.
The subsearch is resolved like this
index=index1 OR index2 ...
Splunk interprets your search like this:
index=index1 OR index=index2 ... | rest of your search
Greetings
Tom
Hi,
you can use a subsearch:
[| inputlookup myindexes.csv | table index] | rest of your search
In this example, imagine there is a csv file with a column "index" and in this column you list all your indexes.
The subsearch is resolved like this
index=index1 OR index2 ...
Splunk interprets your search like this:
index=index1 OR index=index2 ... | rest of your search
Greetings
Tom
Thanks Tom, first option worked flawlessly. Appreciate your help.