Splunk Search

Search keyword from file input

phaniraj345
Engager

Hello Team, 

I have about 10K keywords to search. It is not practical to construct a large query like below 

index=dev (key=val1 OR key=val2 OR key=val3.....key=val10000)

Is there any other way to search?

Thanks

Phaniraj

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Could you try to put those keywords on lookup file or kv-table and use it as a sub search?

Something like this

index=dev [ |inputlookup keys.csv | fields key | format ]

r. Ismo 

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Could you try to put those keywords on lookup file or kv-table and use it as a sub search?

Something like this

index=dev [ |inputlookup keys.csv | fields key | format ]

r. Ismo 

0 Karma

phaniraj345
Engager

Hi, 

Should key (fields key) be the name of the field in the event log?

Thanks

Phaniraj

0 Karma

phaniraj345
Engager

Hi, 

I got the query working. Thanks a lot for the help!

Thanks

Phaniraj

0 Karma

samneo
Path Finder

could you just do something like the below with a wildcard

index=dev key=val* | stats count by key

0 Karma

phaniraj345
Engager

I can't use the regular express * as the values are unique without any patterns

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...