Splunk Search

Using inputlookup value as source in search

eoghanmcd
Engager

Hello,

I'm new to Splunk so sorry if this seems like a basic question.

Previously, in my search I was listing various sources in the query itself:

  index=my_index  host=my_host  source="comp_1.log" OR source="comp_2.log" OR ...) "keyword I'm looking for in event"

However, that was getting difficult to maintain and doesn't really fit my requirements so I have now moved my sources to a lookup file with a structure like this:

sources.csv

source,
"comp_1.log"
"comp_2.log"
...
"comp_n.log"

My question is can I use these values in a search in a similar way to how I would use tokens?

I tried something like this but am not getting any results

|inputlookup sources.csv | search  index=my_index  host=my_host  source=source "keyword I'm looking for in event"

I'm sure this is something that can be done and that I'm just making a mistake somewhere.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try a subsearch.

index=my_index  host=my_host  [ | inputlookup sources.csv | format ] "keyword I'm looking for in event"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try a subsearch.

index=my_index  host=my_host  [ | inputlookup sources.csv | format ] "keyword I'm looking for in event"
---
If this reply helps you, Karma would be appreciated.

eoghanmcd
Engager

I hadn't come across format to concatenate values before but it suits my needs perfectly, here thanks

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...