03 April 2015

Splunk CLI search


#!/bin/sh
inputfile=/root/criptocardlist
logfile=/root/splunksearchresult.log

if [ -e $inputfile ]; then
        cat $inputfile | while read cryptocard
        do
        result=$(/opt/splunk/bin/splunk search "vpn="ive" "$cryptocard"" -maxout 1)
        echo $cryptocard, $result >> $logfile
        done
else
        echo "Input file does not exists"
fi


splunk search command return only one result (maxout 1).