searching issue

[roopeshetty]

Hi Guys,

We have this query which will give the output as a table with 3 columns in it by name Servername, ServerIP and ServerLocation.

| inputlookup WindowsTag.csv

Now we are trying to add the Search input using a token , so modified the query as below;

| inputlookup WindowsTag.csv | search Servername=$mytoken$

But here problem is when we search a text it will search only in column “Servername”, but we want to search for that text in all the available columns (Servername, ServerIP and ServerLocation) in that table. Can we do that? We tried tweaking the query in many ways but no luck.

Can someone please guide us how to do this?

[gcusello · Accepted solution]

Hi @roopeshetty,

you have to add an eval to your search:

| inputlookup WindowsTag.csv 
| eval _raw=Servername." ".ServerIP." ".ServerLocation
| search $mytoken$
| fields - _raw

to have _raw in your fields to use for the full text search, that eventually you can delete at the end of the search.

Ciao.

Giuseppe

[roopeshetty]

Thanks Giuseppe, you fixed our issue instantly. really appreciate your help.

[gcusello]

Hi @roopeshetty,

good for you, see next time.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

[ITWhisperer]

Have you tried

| inputlookup WindowsTag.csv | search $mytoken$