Getting Data In

How can I filter data in search-time from a generated csv file?

skender27
Contributor

Hi,

I have a csv file, generated each day from a Powershell script under the Splunk app lookups directory.
I use the info in those records with the | inputlookup command in many other searches. The columns are name, surname and domain of the internal company network.

Is there a way to filter (in search time) only some of those records present in the .csv file (maybe in a wildcard fashion - for example: eliminate those which name start with adm*)?

Thanks for any suggestion,
Skender

0 Karma
1 Solution

adayton20
Contributor

If I understand your request, is this sort of what you're looking for?

|inputlookup testlookup1 | search NOT user=adm*

or for just the user field

|inputlookup testlookup1 | fields + user | search NOT user=adm*

(whatever your field is)

alt text

alt text

View solution in original post

adayton20
Contributor

If I understand your request, is this sort of what you're looking for?

|inputlookup testlookup1 | search NOT user=adm*

or for just the user field

|inputlookup testlookup1 | fields + user | search NOT user=adm*

(whatever your field is)

alt text

alt text

woodcock
Esteemed Legend

The inputlookup command is no different than using index=myindex sourcetype=mysourcetype; you have all the same filtering options with additional pipelines of commands. The only difference is that you must do a | search first. So you can do something like this:

| inputlookup | search NOT name="adm*"
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...