Splunk Search

searching issue

roopeshetty
Explorer
Hi Guys,
We have this query which will give the output as a table with 3 columns in it by name Servername, ServerIP and ServerLocation.
 
| inputlookup WindowsTag.csv
 
Now we are trying to add the Search input using a token , so modified the query as below;
 
| inputlookup WindowsTag.csv | search Servername=$mytoken$
 
But here problem is when we search a text it will search only in column “Servername”, but we want to search for that text in all the available columns (Servername, ServerIP and ServerLocation) in that table. Can we do that? We tried tweaking the query in many ways but no luck.
 
Can someone please guide us how to do this?
Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @roopeshetty,

you have to add an eval to your search:

| inputlookup WindowsTag.csv 
| eval _raw=Servername." ".ServerIP." ".ServerLocation
| search $mytoken$
| fields - _raw

to have _raw in your fields to use for the full text search, that eventually you can delete at the end of the search.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @roopeshetty,

you have to add an eval to your search:

| inputlookup WindowsTag.csv 
| eval _raw=Servername." ".ServerIP." ".ServerLocation
| search $mytoken$
| fields - _raw

to have _raw in your fields to use for the full text search, that eventually you can delete at the end of the search.

Ciao.

Giuseppe

View solution in original post

0 Karma

roopeshetty
Explorer

Thanks Giuseppe, you fixed our issue instantly. really appreciate your help.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @roopeshetty,

good for you, see next time.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

ITWhisperer
Legend

Have you tried

| inputlookup WindowsTag.csv | search $mytoken$
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!