Using IN with lookup table?

[MScottFoley]

Is something like this possible? 

index=main  sourcetype=iis
host IN (| inputlookup serverlistA.csv)

 I think the problem may be that inputlookup is a generating command and IN is evaluated before the inputlookup is done.  I am looking for another way to do something similar.  This is what I currently do

country IN (Afghanistan Albania Algeria Andorra 
...
187 more
...
Vietnam  Yemen Zambia Zimbabwe)  

The countries are just an example.  I have dozens of various size dynamic lists that  I need to check in different searches.        

[gcusello · Accepted solution]

Hi @MScottFoley,

sorry, but you don't need the IN operator, yu can run a simple subsearch

you have only to put attention that the key field name (host) is the same both in the lookup and in the main search, otherwise, you have to rename it in th subsearch.

Something like this:

index=main  sourcetype=iis [ | inputlookup serverlistA.csv | fields host ]
| ...

Ciao.

Giuseppe

[MScottFoley]

That worked great.  Many thanks.    

[gcusello]

Hi @MScottFoley.,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉