Splunk Search

Is there a splunk equivalent for 'grep -f' ?

alcm_b
Engager

In *NIX, there is a command

grep -f 'long_list_of_regex' 'my_log_file'

, which reads a list of search commands from file. I wonder if there is an equivalent for that in Splunk. Basically - is there a way to perform a search for each of (quite long) list of regex, without making a long search query out of them?

Tags (2)
0 Karma

Ayn
Legend

Does it have to be regular expressions or would regular search expressions that can be understood by the search command suffice? If so, you could use subsearches for this. Setup your file with search expressions as a lookup in Splunk, and then read that file into a subsearch. Let's say your lookup is called searchstrings.csv and looks like this:

query
expression1
expression2
expression3
...

Then if you issue a search like this:

* [|inputlookup searchstrings.csv | fields query]

The subsearch will expand into a filter string so the search will look something like this in the end:

* (("expression1") OR ("expression2") OR ("expression3") OR ... )

I imagine this is something similar to what you want to do.

Note that the field "query" that I used in the example lookup is a special field name that makes Splunk output a "raw" filter string in the search. If you call it something else, say, "blah", the subsearch will instead expand to ((blah="expression1") OR ... )

alcm_b
Engager

I want to something similar to 'inputlookup', but with regular expressions.

To be more specific, I have a file with error message templates used by application, and I search for corresponding actual errors in application log files. Regex examples:
File not found: .*
Invalid value '.' is provided for parameter '.'.

Thanks for 'inputlookup' explanation anyway.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...