Splunk Search

searching issue

roopeshetty
Path Finder
Hi Guys,
We have this query which will give the output as a table with 3 columns in it by name Servername, ServerIP and ServerLocation.
 
| inputlookup WindowsTag.csv
 
Now we are trying to add the Search input using a token , so modified the query as below;
 
| inputlookup WindowsTag.csv | search Servername=$mytoken$
 
But here problem is when we search a text it will search only in column “Servername”, but we want to search for that text in all the available columns (Servername, ServerIP and ServerLocation) in that table. Can we do that? We tried tweaking the query in many ways but no luck.
 
Can someone please guide us how to do this?
Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @roopeshetty,

you have to add an eval to your search:

| inputlookup WindowsTag.csv 
| eval _raw=Servername." ".ServerIP." ".ServerLocation
| search $mytoken$
| fields - _raw

to have _raw in your fields to use for the full text search, that eventually you can delete at the end of the search.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @roopeshetty,

you have to add an eval to your search:

| inputlookup WindowsTag.csv 
| eval _raw=Servername." ".ServerIP." ".ServerLocation
| search $mytoken$
| fields - _raw

to have _raw in your fields to use for the full text search, that eventually you can delete at the end of the search.

Ciao.

Giuseppe

0 Karma

roopeshetty
Path Finder

Thanks Giuseppe, you fixed our issue instantly. really appreciate your help.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @roopeshetty,

good for you, see next time.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Have you tried

| inputlookup WindowsTag.csv | search $mytoken$
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...