Refine your search:

I am pretty sure this involves lookups but here is what I am attempting.

I have a list of users in a CSV (users.csv) but it's about 70 names. I want to search a certain sourcetype for these names without having to finger bang them in one at a time. How do I do this? I feel like this is covered somewhere and I have RTFM already. Any assistance with an answer or at least a nudge in the right direction would be greatly appreciated!

asked 15 Aug '11, 14:14

ryangibson99's gravatar image

ryangibson99
311
accept rate: 0%


2 Answers:

you actually can do that quite easily (I had the same issue):

sourcetype=*yoursourcetype* [ | inputlookup users.csv | fields user]

This will expand to something like this:

sourcetype=*yoursourcetype* user=user1
sourcetype=*yoursourcetype* user=user2

Hope this helps!

link

answered 15 Aug '11, 15:41

Brian%20Osburn's gravatar image

Brian Osburn
2.8k13
accept rate: 22%

AWESOME! Thanks so much!

link

answered 18 Aug '11, 10:29

ryangibson99's gravatar image

ryangibson99
311
accept rate: 0%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×96
×30

Asked: 15 Aug '11, 14:14

Seen: 791 times

Last updated: 18 Aug '11, 10:29

Copyright © 2005-2012 Splunk, Inc. All rights reserved.