Splunk Search

Use field values in a query for loop

nwong1
New Member

Hi, I want to use field values for a search query and then export the results for each field value to a CSV
For example, I have a list of field values

Then for each of these values, I will use them in a search query

list = [1,2,3]

for LIST_VALUE in list:
"index="foo" source="bar"
where name=<LIST_VALUE>

outputcsv <LIST_VALUE>.csv 

Is this possible? Thanks!

Tags (1)
0 Karma

to4kawa
Ultra Champion

use map command

Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...