Splunk Search

search field for many values

ltruesda
Explorer

I need a search which returns events where a specific field contains any one of many values. Typically this is done with the "OR" logical operator. However, I need to search for thousands of values which cannot be expressed using a regular expression.

I've seen discussions of using "lookups" for this. However, if I understand correctly, that would require administrative access to the Splunk server (which I don't have) to configure the lookup file and later update it.

I've also seen suggestions to write a script to generate a massive search string with all the "OR"s in it. I'd like to investigate other solutions before adopting that idea.

Ideally, I'd like to provide the list of field values to match in a file.

Is there a way?

Thanks,

Larry

Tags (3)
0 Karma
1 Solution

lguinn2
Legend

You don't need administrative access to the Splunk server to create a lookup. You can use the GUI.
The instructions are in the Splunk Tutorial here

View solution in original post

lguinn2
Legend

You don't need administrative access to the Splunk server to create a lookup. You can use the GUI.
The instructions are in the Splunk Tutorial here

ltruesda
Explorer

I confirmed that it is true that you can provision the lookup_file via manager. 🙂

I ended up using "... | lookup lookup_file.csv user_id_field as user | search tag_field = 1" where the lookup_file has two columns, user_id_field and tag_field". And each row contains a userid and a '1'.

Works great. Thanks!

0 Karma

stevenacasey
New Member

splunk tutorial link is broken

0 Karma

ltruesda
Explorer

Hello, thanks for your suggestion, but as mentioned in my question I have looked into lookups and I believe it would require administrative access to the Splunk server to configure (e.g. edit .conf file and upload lookup file to appropriate folder) and maintain (e.g. replace lookup file when the search terms change) the lookup files. This is something I do not have and cannot get.

0 Karma

kristian_kolb
Ultra Champion

Perhaps you can investigate the inputlookup / outputlookup methods of creating and maintaining a lookup file, e.g.

|inputlookup file | modify stuff | outputlookup file

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Inputlookup
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup

http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/

/K

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...