Splunk Search

inclusion of .csv file in search

b1nki3
Explorer

I remember being able to include a standard text file, perhaps a .csv, in the 3.x branch. The search would then iterate line-by-line through the entries in said file, much like a subsearch would work. While I suspect I could do this with a python script of some kind, is there any way to do this in 4.x? The use case scenario in this case could be iterating through a very long list of domain names.

Thanks!

Tags (1)

b1nki3
Explorer

It looks like this answer works out a bit better:

http://answers.splunk.com/questions/4044/how-can-i-set-up-a-watchlist

Simeon
Splunk Employee
Splunk Employee

There are a few ways you can input files as search terms.

inputcsv and inputlookup

http://www.splunk.com/base/Documentation/latest/SearchReference/Inputcsv http://www.splunk.com/base/Documentation/latest/SearchReference/Inputlookup

Both of the above commands should allow you to input a csv or similar data.

b1nki3
Explorer

The Inputcsv bit doesn't quite do what I was looking for, unless I am confused about its operation.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...