Splunk Search

Input a file into a query, possible?

gfoligna0
Explorer

We're working with really long queries (with a lot of excludes) and we're looking for a solution to short the query and to edit a single file every time we need to add another exclude.

Is it clear to get the point?

Example:

sourcetype=syslog "pattern1" NOT ("blah1" OR "blah2" OR "blah3" OR "blah4" OR "blah5") | stats count by host

Goal:

sourcetype=syslog "pattern1" NOT ( [file somewhere into the splunk searchead] ) | stats count by host

1 Solution

Ayn
Legend

Sure. You could create a lookup file somewhere, say for instance $SPLUNK_HOME/etc/system/lookups/excludefilters.csv, and refer to this in a subsearch pretty much like what you're suggesting yourself. The lookup file would have a header first of all defining what field Splunk should read each line's contents into, after that you put one query per line. So for instance with an excludefilters.csv that looks like this:

query
blah1
blah2
...

You could have a query that uses this in the following way:

sourcetype="syslog" "pattern1" NOT [| inputlookup excludefilters.csv | fields query] | stats count by host

Note that the field name "query" is a special field name that makes the subsearch output just the field value instead of fieldname=fieldvalue. So, make sure to use "query" as a field name to have this work for free-text filtering.

View solution in original post

Ayn
Legend

Sure. You could create a lookup file somewhere, say for instance $SPLUNK_HOME/etc/system/lookups/excludefilters.csv, and refer to this in a subsearch pretty much like what you're suggesting yourself. The lookup file would have a header first of all defining what field Splunk should read each line's contents into, after that you put one query per line. So for instance with an excludefilters.csv that looks like this:

query
blah1
blah2
...

You could have a query that uses this in the following way:

sourcetype="syslog" "pattern1" NOT [| inputlookup excludefilters.csv | fields query] | stats count by host

Note that the field name "query" is a special field name that makes the subsearch output just the field value instead of fieldname=fieldvalue. So, make sure to use "query" as a field name to have this work for free-text filtering.

gfoligna0
Explorer

Yes, spaces, parenthesis... 🙂

Thank you so much!

0 Karma

gfoligna0
Explorer

The solution is perfect.
Should I escape the spaces to look for the complete line instead of every word? Because I found that when I put spaces it starts to search and match for a single word.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...