Getting Data In

Help searching a CSV file with multiple conditions

adecroix
New Member

Hi,

I spent a lot of hours to find the request I need with no success so I ask your help.

My goal is to build a request with multiple fields condition values extract from a CSV.

I have a CSV file with the below construction

| inputlookup nios_member_ip_lookup | fields MEMBER_IP

MEMBER_IP
192.168.1.xx1
192.168.3.xx2
192.168.1.xx5
192.168.1.xx7
192.168.1.xx0
192.168.xx.x0
192.168.x.xx5
192.168.x.xx0
192.168.x.xx0
192.168.x.xx3

Based on this result, I would have all results from each defined value for a field like:

index=ib_dns_summary report=si_dns_top_clients CLIENT=@IP1 OR CLIENT=@IP2 OR CLIENT=@IP3 ...

So I think I need to build a subsearch request, but I failed to do that. I tried this:

index=ib_dns_summary report=si_dns_top_clients CLIENT="$member_ip" [| inputlookup nios_member_ip_lookup | fields MEMBER_IP | rename MEMBER_IP as member_ip]

Thanks a lot for your help.

0 Karma
1 Solution

pradeepkumarg
Influencer
index=ib_dns_summary report=si_dns_top_clients  [| inputlookup nios_member_ip_lookup | fields MEMBER_IP | rename MEMBER_IP as CLIENT | table CLIENT | format]

View solution in original post

0 Karma

pradeepkumarg
Influencer
index=ib_dns_summary report=si_dns_top_clients  [| inputlookup nios_member_ip_lookup | fields MEMBER_IP | rename MEMBER_IP as CLIENT | table CLIENT | format]
0 Karma

adecroix
New Member

Works fine, thanks a lot for your help 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...