Use Lookup To Filter Events

[HeinzWaescher]

Hi,

in my searches I want to filter my events when the field "Version" has specific values. The list of values I want to include in the searches will increase over time and would it be nice to have an ease way to handle this, instead of adjusting all searches everytime.

Is it possible to use a lookuptable in the a search to achieve this? So that I will just have to adjust the lookuptable to define the filter for my needed "Versions".

Thanks in advance

Heinz

[bagarwal]

Hi @Damien Dallimore [Splunk],

I tried for similar outcome to search my query ; however no result is found.
Note: In my .csv file there is only one column and it looks like below:
Application
abc*
xyz*
aaa* n so on.

Query is
index="index_name" [ | inputlookup "filename" | fields Application ] | table field1, field2

Anything I am missing. Kindly help.

Thanks & Regards,
Binay Agarwal

[Damien_Dallimor · Accepted solution]

You could use the inputlookup command to do this.

So you might have a lookup file called versions.csv

Version
1.0
2.0
3.0

And then you can use a search like :

<search terms> [ | inputlookup <your lookup> ]

index=foo sourcetype=goo [ | inputlookup versions | fields Version ]

[HeinzWaescher]

Ok, that's nice. Thanks a lot for your help!

[Damien_Dallimor]

Exact matches. So your lookup file will need all the versions explictly entered.

[HeinzWaescher]

Hi,

thanks, that's a way I was looking for 🙂
Will this kind of command filter exact matches of the fieldvalue? Or will the output include a Version 1.0.1 as well, when your example above is used?