#Splunk lookup file software

There may be more approaches and you are welcome to discuss them in the comments. In short, today’s blog entry gave you one possible way to use the content of a file for input for your disjunctive search. You can then copy and paste the the values into your CSV file.

Sourcetype=mail | top limit=100 ip | fields + ip Simply run the following search assuming you want the top 100 values for IP in our example: Finally, if your requirement is that you want to search on the top N (N is an integer) values for a field each day, Splunk can help you create the CSV input file. In essence, this last step will do your disjunctive search for you without having to type in a long sequence of OR terms. The last search command will find all events that contain the given values of myip from the file. Sourcetype=mail | lookup search_ip ip OUTPUT myip | search myip=* You are now ready to use your file as input to search for all events that contain ip addresses that were in your CSV file. Now, from your browser, log into Splunk and reload the nf and nf file for your new additions: Second, edit nf and use your sourcetype to start the stanza. Now, in your SPLUNK_HOME/etc/apps//local directory you’ll need to create or modify two files. Since I’m not interested in creating a real mapping from one field (ip) to another (myip), I used the same value in both columns to conform to the syntactical usage of the lookup command. I created iptable.csv with the following sample content to be used for input. Next, create a CSV file in your SPLUNK_HOME/etc/app//lookups/ directory.

For our example I’ll use an ip address field. For now, I will assume you have basic knowledge about its usage and I will list a possible solution for trying to use OR with many possible values for a field.įirst, use field extraction to extract the field in question. For an introduction to this command, please consult Bob Fox’s blog entry discussing example usage. With Splunk 4.0, one way this is possible out of the box is with the new lookup command. A solution is to have an external file that contains all the possible values that you would like to use in the disjunctive search be used within the search language as input to the search criteria. This works fine for a finite case where you only have a handful of planets, but what happens if the field’s possible search criteria changes daily and may contain hundreds of possible values that you would like to input for the search? Certainly, using OR terms with over a hundred entries sounds impractical. Sourcetype=my_sourcetype (planet=mars OR planet=earth OR planet=saturn) It’s essentially using an OR (disjunctive search) in the search language. If i create lookup with exact matches, it works for the match everytime, however, my client requires only prefixchecks, and to me WILDCARD is the only solution.I’ve been asked a few times on how best to search for events which may contain many different discrete values for a field.

Share the lookup definition with all apps Now that you have created the lookup definition, you need to specify in which apps you want to use the lookup table.

#Splunk lookup file software

Lookup prefixlookup.csv prefix OUTPUT state | The Splunk software automatically interprets the first row in a CSV lookup table file as the field names, or column headings, for the lookup table. Source='log2.log' host='prod-splunk-indexer' sourcetype='testsource' | Here is a simple search line just to illustrate It is exactly as in the example in the link. I have used the GUI to create the lookup definitions, but i have also double-cheked nf and nf. I have a simple lookup csv file (2 columns ), first one with starting digits I have a challenge, that i have been struggling for the past few days, and can't find the correct solution.Īnd done pretty much exactly the same thing, but it doesn't work for me.