Splunk Search

Using inputlookup value as source in search

eoghanmcd
Engager

Hello,

I'm new to Splunk so sorry if this seems like a basic question.

Previously, in my search I was listing various sources in the query itself:

  index=my_index  host=my_host  source="comp_1.log" OR source="comp_2.log" OR ...) "keyword I'm looking for in event"

However, that was getting difficult to maintain and doesn't really fit my requirements so I have now moved my sources to a lookup file with a structure like this:

sources.csv

source,
"comp_1.log"
"comp_2.log"
...
"comp_n.log"

My question is can I use these values in a search in a similar way to how I would use tokens?

I tried something like this but am not getting any results

|inputlookup sources.csv | search  index=my_index  host=my_host  source=source "keyword I'm looking for in event"

I'm sure this is something that can be done and that I'm just making a mistake somewhere.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try a subsearch.

index=my_index  host=my_host  [ | inputlookup sources.csv | format ] "keyword I'm looking for in event"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try a subsearch.

index=my_index  host=my_host  [ | inputlookup sources.csv | format ] "keyword I'm looking for in event"
---
If this reply helps you, Karma would be appreciated.

eoghanmcd
Engager

I hadn't come across format to concatenate values before but it suits my needs perfectly, here thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...