Splunk Search

Using IN with lookup table?

MScottFoley
Path Finder

Is something like this possible? 

 

index=main  sourcetype=iis
host IN (| inputlookup serverlistA.csv)

 


 I think the problem may be that inputlookup is a generating command and IN is evaluated before the inputlookup is done.  I am looking for another way to do something similar.  This is what I currently do

 

country IN (Afghanistan Albania Algeria Andorra 
...
187 more
...
Vietnam  Yemen Zambia Zimbabwe)  

 


The countries are just an example.  I have dozens of various size dynamic lists that  I need to check in different searches.        

 

 

 

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @MScottFoley,

sorry, but you don't need the IN operator, yu can run a simple subsearch

you have only to put attention that the key field name (host) is the same both in the lookup and in the main search, otherwise, you have to rename it in th subsearch.

Something like this:

index=main  sourcetype=iis [ | inputlookup serverlistA.csv | fields host ]
| ...

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @MScottFoley,

sorry, but you don't need the IN operator, yu can run a simple subsearch

you have only to put attention that the key field name (host) is the same both in the lookup and in the main search, otherwise, you have to rename it in th subsearch.

Something like this:

index=main  sourcetype=iis [ | inputlookup serverlistA.csv | fields host ]
| ...

Ciao.

Giuseppe

0 Karma

MScottFoley
Path Finder

That worked great.  Many thanks.    

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @MScottFoley.,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...