One source of truth

[drezanka]

I have an app with dozens of searches that refer to "groupings" of indexes based on several types of criteria. I would like to have one "source of truth" for each grouping so when a index is retired and new ones are added I can just edit one thing instead of dozens of searches.  I have tried using a csv lookup but am having problems getting the search to work. Here is a simplified example of the csv file:

type,index_list
rabbits,index="bunny_index" OR index="jackrabbit_index"
stones,index="turquoise" OR index="slate"
dogs,index="spaniels" OR index="hounds"
all,index="bunny_index" OR index="jackrabbit_index" OR index="turquoise" OR index="slate" OR index="spaniels" OR index="hounds"
mammals="bunny_index" OR index="jackrabbit_index" OR "spaniels" OR index="hounds"

I have tried running:

| inputlookup mycsvfile where type=rabbits   | search index_list

but I get "No results found." (If I run index="bunny_index" OR index="jackrabbit_index" I do get results). 

Grabbing that list of indexes to search from a centralized location would be a huge improvement over our current setup so any input would be very much appreciated.

[drezanka]

That works! Thank you.

[richgalloway · Accepted solution]

The problem with the existing query is the search command is looking in the default indexes for the literal string "index=bunny_index OR index=jackrabbit_index", which seems unlikely to be found.  Try using the return command to extract the value of the index_list field.

sourcetype=* [| inputlookup mycsvfile where type=rabbits | return $index_list]
| ...