Splunk Search

Retrieve values from json file

sdhiaeddine
Explorer

Hi,

I need to filter my query for a specific field_value. The working query is as follow:

index=_index (field_value="value1" OR field_value="value4" OR field_value="value14") | .....


Now, I would like to retrieve those field values from a remote json file and pass it to search condition this way:

index=_index (field_value in listOfFieldValuesFromRemoteJson) | .....


Could you please help me make it work?

The json file : [{"field_value": "value1"},{"field_value": "value4"},{"field_value": "value14"}]

Best regards,
Dhiaeddine

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Have you already ingested the "remote" file or made it available through a KV store?

How often does the remote file change?

0 Karma

sdhiaeddine
Explorer

Hi @ITWhisperer 


Have you already ingested the "remote" file or made it available through a KV store?


Not yet, I'm still looking on how to do it


How often does the remote file change?


About once a month I update the json file

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK once you get the data ingested, it will be easier to use it

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...