Getting Data In

inputcsv match anywhere

reed_kelly
Contributor

I have a list of usernames in a CSV file. I want to find any events that contain any of these usernames in _raw. I cannot guarantee that there is a field called user or affected_user for every event, so I want to match anywhere in the string. If I try the following, it only matches for the first user:

.. [ inputcsv userlist.csv |return $user ]

but this only matches on the first user in the list.

Does anyone know how I can match any of the users (words) in a list?

This should be the same whether I am using inputcsv or inputlookup.

0 Karma
1 Solution

Ayn
Legend
... [inputcsv userlist.csv | rename user as query | fields query]

"query" (or "search" if you prefer, has same effect) is a special field name that makes Splunk omit the 'field=value' formatting when returning from a subsearch.

View solution in original post

Ayn
Legend
... [inputcsv userlist.csv | rename user as query | fields query]

"query" (or "search" if you prefer, has same effect) is a special field name that makes Splunk omit the 'field=value' formatting when returning from a subsearch.

reed_kelly
Contributor

Running 4.3.1 search head...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...