Splunk Search

Using inputlookup value as source in search

eoghanmcd
Engager

Hello,

I'm new to Splunk so sorry if this seems like a basic question.

Previously, in my search I was listing various sources in the query itself:

  index=my_index  host=my_host  source="comp_1.log" OR source="comp_2.log" OR ...) "keyword I'm looking for in event"

However, that was getting difficult to maintain and doesn't really fit my requirements so I have now moved my sources to a lookup file with a structure like this:

sources.csv

source,
"comp_1.log"
"comp_2.log"
...
"comp_n.log"

My question is can I use these values in a search in a similar way to how I would use tokens?

I tried something like this but am not getting any results

|inputlookup sources.csv | search  index=my_index  host=my_host  source=source "keyword I'm looking for in event"

I'm sure this is something that can be done and that I'm just making a mistake somewhere.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try a subsearch.

index=my_index  host=my_host  [ | inputlookup sources.csv | format ] "keyword I'm looking for in event"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try a subsearch.

index=my_index  host=my_host  [ | inputlookup sources.csv | format ] "keyword I'm looking for in event"
---
If this reply helps you, Karma would be appreciated.

eoghanmcd
Engager

I hadn't come across format to concatenate values before but it suits my needs perfectly, here thanks

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...