Splunk Search

To include 80+ applications in SPL

rajatsinghbagga
Explorer

Hello Everyone,

I have got the list of 80+ applications this I want to include in my SPL. Is there a way I can use CSV lookup to do that? The applications list look like:-

APP-ID,DESCRIPTION
A1*,test app 1
B2*,test app 2
C3*,test app 3
D4*,test app 4
...

Sample SPL I would like to create to include these applications:-

index=app-data  APP-ID=A1* OR APP-ID=B2* OR APP-ID=C3* OR APP-ID=D4*.... | 

I am not using the DESCRIPTION as mentioned in the sample CSV above at this stage. I am just trying to figure out if there is a way to look up these applications from a CSV file rather then having to type these in the SPL or if there is any other alternative please suggest.

Thank you,
Rajat

0 Karma
1 Solution

KailA
Contributor

Hello,

If you already have the csv as a lookup, it's perfect.
You can do something like that in your SPL :

index=app-data [|inputlookup yourLookup | fields APP-ID]

It should work for you.

Kail

View solution in original post

KailA
Contributor

Hello,

If you already have the csv as a lookup, it's perfect.
You can do something like that in your SPL :

index=app-data [|inputlookup yourLookup | fields APP-ID]

It should work for you.

Kail

Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...