Splunk Dynamic search using lookup

[rishiaggarwal]

I wish to populate a list of index names ( > 1) from a lookup table to a search query.

Indexlookup.csv -->

COL1

---

index1
index2
index5
index9

search -->

query | search index="index1" OR index="index2" OR index="index5" OR index="index1" | .........................

[Eshaac · Accepted solution]

To do this you should create a csv file which contains the header index
e.g. index
xyz
xyz
xzy

exclude adding "index=" to the index value on the lookup.
once this lookup is created use this search string

[|inputlookup "your_lookup_name"
| search index=*
| eval search="(index=".index.") OR"
| stats values(search) as search
| eval search=tostring(search)
| eval search=substr(search,0,len(search)-3)]

this will then amalgamate the different indexes and run it!

[niketn]

I am not sure what you imply by " index names ( > 1) ", however, instead of using the search you have mentioned you can try the following:

<YourBaseSearch> [|inputlookup Indexlookup.csv | rename COL1 as index| table index]
| <Your Remaining Search>

[dineshraj9]

Try this way -

query | search [ | inputlookup Indexlookup.csv | rename COL1 as index | table index ] | ...

OR

query | search [ | inputlookup Indexlookup.csv | rename COL1 as index | table index | format ] | ...

[gcusello]

Hi rishiaggarwal,
to do this, you have to put your indexes in a lookup with column name called index and use it in a subsearch

your_search [ | inputlookup your_indexes.csv | fields index ] | ...

I don't like this solution, I prefer to put indexes in an eventtype and use it in my searches.

Bye.
Giuseppe