Splunk search csv number

[Crotyo]

I have a csv file like this that contain more than 100 numbers

11111111

22222222

33333333

I want to search for events that contain these number.

I can use index=* "11111111" OR "22222222" 

but it take way to long. Is there a faster way?

these number does not have a seperate fields or am i searching in any fields. im just searching for any event log that contain these number. Can anyone help? Thanks.

[ITWhisperer]

Assuming your csv is called numbers.csv and the field if called number, try something like this

index=* [| inputlookup numbers.csv | rename number as search | table search]

[PickleRick]

Close. But not complete.

index=* [| inputlookup numbers.csv | rename number as search | table search | format ]

Without the final format command Splunk will use only first row of the subsearch results as a condition. So it will only look for the first value from the lookup.

[Crotyo]

I did try that and the search result return empty.

[PickleRick]

Whether it takes long to search it depends on your data. If these are really long and fairly unique terms, they can be (relatively) quickly searchable provided that you're looking strictly for those terms, not some wildcarded variations (especially with wildcard not at the end of the search term).

[gcusello]

Hi @Crotyo ,

you should put the csv file in a lookup (called e.g. "my_lookup.csv", containing at least one field (e.g. "my_field") and then run a search like the following:

index=* [ | inputlookup my_lookup.csv | rename my_field AS query | fields query ]
| ...

in this way you perform a search in full text search mode on all the events.

Ciao.

Giuseppe

[Crotyo]

I tried that and the search return empty. I tried checking the inputlookup command and it did list all the numbers.

[gcusello]

Hi @Crotyo ,

could you share your search?

Ciao.

Giuseppe

[Crotyo]

Here's picture of my csv files and search result. It only display the result for the first number. When I search using OR, it does display correctly

[gcusello]

Hi @Crotyo ,

I see from your screenshot that you have results, so what's the issue?

Ciao.

Giuseppe