Splunk Search

One source of truth

drezanka
Explorer

I have an app with dozens of searches that refer to "groupings" of indexes based on several types of criteria. I would like to have one "source of truth" for each grouping so when a index is retired and new ones are added I can just edit one thing instead of dozens of searches.  I have tried using a csv lookup but am having problems getting the search to work. Here is a simplified example of the csv file:

type,index_list
rabbits,index="bunny_index" OR index="jackrabbit_index"
stones,index="turquoise" OR index="slate"
dogs,index="spaniels" OR index="hounds"
all,index="bunny_index" OR index="jackrabbit_index" OR index="turquoise" OR index="slate" OR index="spaniels" OR index="hounds"
mammals="bunny_index" OR index="jackrabbit_index" OR "spaniels" OR index="hounds"

I have tried running:

| inputlookup mycsvfile where type=rabbits   | search index_list

but I get "No results found." (If I run index="bunny_index" OR index="jackrabbit_index" I do get results). 

Grabbing that list of indexes to search from a centralized location would be a huge improvement over our current setup so any input would be very much appreciated.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The problem with the existing query is the search command is looking in the default indexes for the literal string "index=bunny_index OR index=jackrabbit_index", which seems unlikely to be found.  Try using the return command to extract the value of the index_list field.

sourcetype=* [| inputlookup mycsvfile where type=rabbits | return $index_list]
| ...

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

drezanka
Explorer

That works! Thank you.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The problem with the existing query is the search command is looking in the default indexes for the literal string "index=bunny_index OR index=jackrabbit_index", which seems unlikely to be found.  Try using the return command to extract the value of the index_list field.

sourcetype=* [| inputlookup mycsvfile where type=rabbits | return $index_list]
| ...

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...