I have an app with dozens of searches that refer to "groupings" of indexes based on several types of criteria. I would like to have one "source of truth" for each grouping so when a index is retired and new ones are added I can just edit one thing instead of dozens of searches. I have tried using a csv lookup but am having problems getting the search to work. Here is a simplified example of the csv file:
type,index_list
rabbits,index="bunny_index" OR index="jackrabbit_index"
stones,index="turquoise" OR index="slate"
dogs,index="spaniels" OR index="hounds"
all,index="bunny_index" OR index="jackrabbit_index" OR index="turquoise" OR index="slate" OR index="spaniels" OR index="hounds"
mammals="bunny_index" OR index="jackrabbit_index" OR "spaniels" OR index="hounds"
I have tried running:
| inputlookup mycsvfile where type=rabbits | search index_list
but I get "No results found." (If I run index="bunny_index" OR index="jackrabbit_index" I do get results).
Grabbing that list of indexes to search from a centralized location would be a huge improvement over our current setup so any input would be very much appreciated.
The problem with the existing query is the search command is looking in the default indexes for the literal string "index=bunny_index OR index=jackrabbit_index", which seems unlikely to be found. Try using the return command to extract the value of the index_list field.
sourcetype=* [| inputlookup mycsvfile where type=rabbits | return $index_list]
| ...
That works! Thank you.
The problem with the existing query is the search command is looking in the default indexes for the literal string "index=bunny_index OR index=jackrabbit_index", which seems unlikely to be found. Try using the return command to extract the value of the index_list field.
sourcetype=* [| inputlookup mycsvfile where type=rabbits | return $index_list]
| ...