Splunk Search

Use field values in a query for loop

nwong1
New Member

Hi, I want to use field values for a search query and then export the results for each field value to a CSV
For example, I have a list of field values

Then for each of these values, I will use them in a search query

list = [1,2,3]

for LIST_VALUE in list:
"index="foo" source="bar"
where name=<LIST_VALUE>

outputcsv <LIST_VALUE>.csv 

Is this possible? Thanks!

Tags (1)
0 Karma

to4kawa
Ultra Champion

use map command

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

test

test

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Tech Talk Recap   From Chaos to Control: Scaling Splunk Cloud with Infrastructure as Code Managing apps in ...