Is something like this possible?
index=main sourcetype=iis
host IN (| inputlookup serverlistA.csv)
I think the problem may be that inputlookup is a generating command and IN is evaluated before the inputlookup is done. I am looking for another way to do something similar. This is what I currently do
country IN (Afghanistan Albania Algeria Andorra
...
187 more
...
Vietnam Yemen Zambia Zimbabwe)
The countries are just an example. I have dozens of various size dynamic lists that I need to check in different searches.
Hi @MScottFoley,
sorry, but you don't need the IN operator, yu can run a simple subsearch
you have only to put attention that the key field name (host) is the same both in the lookup and in the main search, otherwise, you have to rename it in th subsearch.
Something like this:
index=main sourcetype=iis [ | inputlookup serverlistA.csv | fields host ]
| ...
Ciao.
Giuseppe
Hi @MScottFoley,
sorry, but you don't need the IN operator, yu can run a simple subsearch
you have only to put attention that the key field name (host) is the same both in the lookup and in the main search, otherwise, you have to rename it in th subsearch.
Something like this:
index=main sourcetype=iis [ | inputlookup serverlistA.csv | fields host ]
| ...
Ciao.
Giuseppe
That worked great. Many thanks.
Hi @MScottFoley.,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉