Splunk Search

Use Lookup To Filter Events

Motivator

Hi,

in my searches I want to filter my events when the field "Version" has specific values. The list of values I want to include in the searches will increase over time and would it be nice to have an ease way to handle this, instead of adjusting all searches everytime.

Is it possible to use a lookuptable in the a search to achieve this? So that I will just have to adjust the lookuptable to define the filter for my needed "Versions".

Thanks in advance

Heinz

Tags (2)
1 Solution

Ultra Champion

You could use the inputlookup command to do this.

So you might have a lookup file called versions.csv

Version
1.0
2.0
3.0

And then you can use a search like :

<search terms> [ | inputlookup <your lookup> ]

index=foo sourcetype=goo [ | inputlookup versions | fields Version ]

View solution in original post

Path Finder

Hi @Damien Dallimore [Splunk],

I tried for similar outcome to search my query ; however no result is found.
Note: In my .csv file there is only one column and it looks like below:
Application
abc*
xyz*
aaa* n so on.

Query is
index="index_name" [ | inputlookup "filename" | fields Application ] | table field1, field2

Anything I am missing. Kindly help.

Thanks & Regards,
Binay Agarwal

0 Karma

Ultra Champion

You could use the inputlookup command to do this.

So you might have a lookup file called versions.csv

Version
1.0
2.0
3.0

And then you can use a search like :

<search terms> [ | inputlookup <your lookup> ]

index=foo sourcetype=goo [ | inputlookup versions | fields Version ]

View solution in original post

Motivator

Ok, that's nice. Thanks a lot for your help!

0 Karma

Ultra Champion

Exact matches. So your lookup file will need all the versions explictly entered.

0 Karma

Motivator

Hi,

thanks, that's a way I was looking for 🙂
Will this kind of command filter exact matches of the fieldvalue? Or will the output include a Version 1.0.1 as well, when your example above is used?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!