Splunk Search

Input a file into a query, possible?

gfoligna0
Explorer

We're working with really long queries (with a lot of excludes) and we're looking for a solution to short the query and to edit a single file every time we need to add another exclude.

Is it clear to get the point?

Example:

sourcetype=syslog "pattern1" NOT ("blah1" OR "blah2" OR "blah3" OR "blah4" OR "blah5") | stats count by host

Goal:

sourcetype=syslog "pattern1" NOT ( [file somewhere into the splunk searchead] ) | stats count by host

1 Solution

Ayn
Legend

Sure. You could create a lookup file somewhere, say for instance $SPLUNK_HOME/etc/system/lookups/excludefilters.csv, and refer to this in a subsearch pretty much like what you're suggesting yourself. The lookup file would have a header first of all defining what field Splunk should read each line's contents into, after that you put one query per line. So for instance with an excludefilters.csv that looks like this:

query
blah1
blah2
...

You could have a query that uses this in the following way:

sourcetype="syslog" "pattern1" NOT [| inputlookup excludefilters.csv | fields query] | stats count by host

Note that the field name "query" is a special field name that makes the subsearch output just the field value instead of fieldname=fieldvalue. So, make sure to use "query" as a field name to have this work for free-text filtering.

View solution in original post

Ayn
Legend

Sure. You could create a lookup file somewhere, say for instance $SPLUNK_HOME/etc/system/lookups/excludefilters.csv, and refer to this in a subsearch pretty much like what you're suggesting yourself. The lookup file would have a header first of all defining what field Splunk should read each line's contents into, after that you put one query per line. So for instance with an excludefilters.csv that looks like this:

query
blah1
blah2
...

You could have a query that uses this in the following way:

sourcetype="syslog" "pattern1" NOT [| inputlookup excludefilters.csv | fields query] | stats count by host

Note that the field name "query" is a special field name that makes the subsearch output just the field value instead of fieldname=fieldvalue. So, make sure to use "query" as a field name to have this work for free-text filtering.

gfoligna0
Explorer

Yes, spaces, parenthesis... 🙂

Thank you so much!

0 Karma

gfoligna0
Explorer

The solution is perfect.
Should I escape the spaces to look for the complete line instead of every word? Because I found that when I put spaces it starts to search and match for a single word.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...