Splunk Search

Storing spl in lookup

hoytn
Explorer

Is it possible to store a search string in a lookup column, retrieve the content and run it as a search?
For example:
index=some_index
| lookup test.csv lookup_key_field as event_code OUTPUT spl_field as search_string
| ... some command to actually run the search_string ...

0 Karma

woodcock
Esteemed Legend

Like this:

index=some_index
| lookup test.csv lookup_key_field AS event_code OUTPUT spl_field AS search_string
| map search="search [|makeresults | eval search=$search_string$ | return $search_string]"

gaurav_maniar
Builder

Hi Hoytn,

please try the below working example,

| makeresults | eval query="sourcetype=splunkd* | head 1" | outputlookup query_lookup.csv

Now get the result from lookup via sub-search,

index=_internal | search [| inputlookup query_lookup.csv | return $query]

Accept the answer if it helps.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...