Splunk Search

inclusion of .csv file in search

b1nki3
Explorer

I remember being able to include a standard text file, perhaps a .csv, in the 3.x branch. The search would then iterate line-by-line through the entries in said file, much like a subsearch would work. While I suspect I could do this with a python script of some kind, is there any way to do this in 4.x? The use case scenario in this case could be iterating through a very long list of domain names.

Thanks!

Tags (1)

b1nki3
Explorer

It looks like this answer works out a bit better:

http://answers.splunk.com/questions/4044/how-can-i-set-up-a-watchlist

Simeon
Splunk Employee
Splunk Employee

There are a few ways you can input files as search terms.

inputcsv and inputlookup

http://www.splunk.com/base/Documentation/latest/SearchReference/Inputcsv http://www.splunk.com/base/Documentation/latest/SearchReference/Inputlookup

Both of the above commands should allow you to input a csv or similar data.

b1nki3
Explorer

The Inputcsv bit doesn't quite do what I was looking for, unless I am confused about its operation.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...