Input a file into a query, possible?

[gfoligna0]

We're working with really long queries (with a lot of excludes) and we're looking for a solution to short the query and to edit a single file every time we need to add another exclude.

Is it clear to get the point?

Example:

sourcetype=syslog "pattern1" NOT ("blah1" OR "blah2" OR "blah3" OR "blah4" OR "blah5") | stats count by host

Goal:

sourcetype=syslog "pattern1" NOT ( [file somewhere into the splunk searchead] ) | stats count by host

[Ayn · Accepted solution]

Sure. You could create a lookup file somewhere, say for instance $SPLUNK_HOME/etc/system/lookups/excludefilters.csv, and refer to this in a subsearch pretty much like what you're suggesting yourself. The lookup file would have a header first of all defining what field Splunk should read each line's contents into, after that you put one query per line. So for instance with an excludefilters.csv that looks like this:

query
blah1
blah2
...

You could have a query that uses this in the following way:

sourcetype="syslog" "pattern1" NOT [| inputlookup excludefilters.csv | fields query] | stats count by host

Note that the field name "query" is a special field name that makes the subsearch output just the field value instead of fieldname=fieldvalue. So, make sure to use "query" as a field name to have this work for free-text filtering.

[gfoligna0]

Yes, spaces, parenthesis... 🙂

Thank you so much!

[gfoligna0]

The solution is perfect.
Should I escape the spaces to look for the complete line instead of every word? Because I found that when I put spaces it starts to search and match for a single word.