I wish to populate a list of index names ( > 1) from a lookup table to a search query.
Indexlookup.csv -->
COL1
index1
index2
index5
index9
search -->
query | search index="index1" OR index="index2" OR index="index5" OR index="index1" | .........................
To do this you should create a csv file which contains the header index
e.g. index
xyz
xyz
xzy
exclude adding "index=" to the index value on the lookup.
once this lookup is created use this search string
[|inputlookup "your_lookup_name"
| search index=*
| eval search="(index=".index.") OR"
| stats values(search) as search
| eval search=tostring(search)
| eval search=substr(search,0,len(search)-3)]
this will then amalgamate the different indexes and run it!
To do this you should create a csv file which contains the header index
e.g. index
xyz
xyz
xzy
exclude adding "index=" to the index value on the lookup.
once this lookup is created use this search string
[|inputlookup "your_lookup_name"
| search index=*
| eval search="(index=".index.") OR"
| stats values(search) as search
| eval search=tostring(search)
| eval search=substr(search,0,len(search)-3)]
this will then amalgamate the different indexes and run it!
I am not sure what you imply by " index names ( > 1) ", however, instead of using the search you have mentioned you can try the following:
<YourBaseSearch> [|inputlookup Indexlookup.csv | rename COL1 as index| table index]
| <Your Remaining Search>
Try this way -
query | search [ | inputlookup Indexlookup.csv | rename COL1 as index | table index ] | ...
OR
query | search [ | inputlookup Indexlookup.csv | rename COL1 as index | table index | format ] | ...
Hi rishiaggarwal,
to do this, you have to put your indexes in a lookup with column name called index and use it in a subsearch
your_search [ | inputlookup your_indexes.csv | fields index ] | ...
I don't like this solution, I prefer to put indexes in an eventtype and use it in my searches.
Bye.
Giuseppe