Splunk Search

Splunk Dynamic search using lookup

Explorer

I wish to populate a list of index names ( > 1) from a lookup table to a search query.

Indexlookup.csv -->

COL1


index1
index2
index5
index9

search -->

query | search index="index1" OR index="index2" OR index="index5" OR index="index1" | .........................

0 Karma
1 Solution

Engager

To do this you should create a csv file which contains the header index
e.g. index
xyz
xyz
xzy

exclude adding "index=" to the index value on the lookup.
once this lookup is created use this search string

[|inputlookup "yourlookupname"
| search index=*
| eval search="(index=".index.") OR"
| stats values(search) as search
| eval search=tostring(search)
| eval search=substr(search,0,len(search)-3)]

this will then amalgamate the different indexes and run it!

View solution in original post

0 Karma

Engager

To do this you should create a csv file which contains the header index
e.g. index
xyz
xyz
xzy

exclude adding "index=" to the index value on the lookup.
once this lookup is created use this search string

[|inputlookup "yourlookupname"
| search index=*
| eval search="(index=".index.") OR"
| stats values(search) as search
| eval search=tostring(search)
| eval search=substr(search,0,len(search)-3)]

this will then amalgamate the different indexes and run it!

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

I am not sure what you imply by " index names ( > 1) ", however, instead of using the search you have mentioned you can try the following:

<YourBaseSearch> [|inputlookup Indexlookup.csv | rename COL1 as index| table index]
| <Your Remaining Search>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Builder

Try this way -

query | search [ | inputlookup Indexlookup.csv | rename COL1 as index | table index ] | ...

OR

query | search [ | inputlookup Indexlookup.csv | rename COL1 as index | table index | format ] | ...
0 Karma

Legend

Hi rishiaggarwal,
to do this, you have to put your indexes in a lookup with column name called index and use it in a subsearch

your_search [ | inputlookup your_indexes.csv | fields index ] | ...

I don't like this solution, I prefer to put indexes in an eventtype and use it in my searches.

Bye.
Giuseppe

0 Karma