I need to search for a list of values for a specific field. How can I do this? The list needs to be dynamic.
Okay, I just thought of a reasonable interpretation for your question. If the question is:
I have a list of values that I need to search for:
error22
error374
error29
This list changes regularly. I need to search Splunk for occurrences of these values.
I don't want to type (error22 OR error374 or error29 ...) in the search box; it is too long and changes too often.
Can I tell Splunk to search for this list of values from a file instead?
Then the answer is still yes: use a lookup table. There is a tutorial on lookups in the manual. Put the list in a .csv and create the lookup table. Then you can use the table to search by giving the following command:
yourothersearchcriteria [ | inputlookup yourlookupname ]
Whenever you need to change the criteria, you can simply upload a fresh copy of the .csv file,
Note that this is NOT doing a lookup! It is actually using the inputlookup
command as part of a subsearch.
This might help out somewhat:
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources
Yes.
If you want more help than that, you will have to provide more detail in your question!
If you can provide a few events from the file (sanitized of course) and an example of what you want to search for, I am sure the community can help. Oh, and what exactly do you mean by "dynamic"? I assume that you mean the search terms will need to change regularly...
🙂