https://community.splunk.com/t5/Getting-Data-In/CSV-Searches/m-p/364834#M66457 <P>Hello everyone. I've been reading and reading and I can not get consistent results from anything I have tried. So hopefully someone can help me get this straight. I have a csv as follows:</P> <P>Indicator Type, Indicator, Description<BR /> domain, google.com, stuff<BR /> hash, asdfasdfdf4a6sd54fa6sd4fa6sd4f6sd, stuff<BR /> file, test.exe, stuff</P> <P>I am trying to conduct a search that uses the Indicator column to search for ANY instances of the indicator. For example, it should return not just google.com, but also mail.google.com, or google.com.net. Additionally, I want to search the entire log, not just a specific field for that value. Here is what kinda works:</P> <PRE><CODE>index=myindex | lookup NamedDefinition Indicator as logField OUTPUT Indicator as IOC | search IOC=* | stats count by IOC </CODE></PRE> <P>That last part doesn't really matter, so it can be fields or whatever. This command works SOMETIMES. Sometimes I get errors that the lookup doesn't exist.</P> <P>However, when it does work, this only searches one field in a log for something that matches in the csv EXACTLY. I tried putting a wildcard in the value (i.e. *google.com) but did not work. I also do not have access to modify any configuration files. I have also seen this command:</P> <PRE><CODE>index=myindex [|inputlookup NamedDefinition.csv | fields Indicator] </CODE></PRE> <P>but that has never returned any results. I know there are results (I use google.com as a control domain as well). Any help would be extremely appreciated.</P> Tue, 03 Oct 2017 15:39:49 GMT rlamezquita 2017-10-03T15:39:49Z https://community.splunk.com/t5/Getting-Data-In/CSV-Searches/m-p/364834#M66457 <P>Hello everyone. I've been reading and reading and I can not get consistent results from anything I have tried. So hopefully someone can help me get this straight. I have a csv as follows:</P> <P>Indicator Type, Indicator, Description<BR /> domain, google.com, stuff<BR /> hash, asdfasdfdf4a6sd54fa6sd4fa6sd4f6sd, stuff<BR /> file, test.exe, stuff</P> <P>I am trying to conduct a search that uses the Indicator column to search for ANY instances of the indicator. For example, it should return not just google.com, but also mail.google.com, or google.com.net. Additionally, I want to search the entire log, not just a specific field for that value. Here is what kinda works:</P> <PRE><CODE>index=myindex | lookup NamedDefinition Indicator as logField OUTPUT Indicator as IOC | search IOC=* | stats count by IOC </CODE></PRE> <P>That last part doesn't really matter, so it can be fields or whatever. This command works SOMETIMES. Sometimes I get errors that the lookup doesn't exist.</P> <P>However, when it does work, this only searches one field in a log for something that matches in the csv EXACTLY. I tried putting a wildcard in the value (i.e. *google.com) but did not work. I also do not have access to modify any configuration files. I have also seen this command:</P> <PRE><CODE>index=myindex [|inputlookup NamedDefinition.csv | fields Indicator] </CODE></PRE> <P>but that has never returned any results. I know there are results (I use google.com as a control domain as well). Any help would be extremely appreciated.</P> Tue, 03 Oct 2017 15:39:49 GMT https://community.splunk.com/t5/Getting-Data-In/CSV-Searches/m-p/364834#M66457 rlamezquita 2017-10-03T15:39:49Z https://community.splunk.com/t5/Getting-Data-In/CSV-Searches/m-p/364835#M66458 <P>Try this ...</P> <PRE><CODE>index=myindex [| inputlookup NamedDefinition.csv | table Indicator | format "(" "" "" "" "OR" ")" | rex mode=sed field=search "s/Indicator=//g"] </CODE></PRE> <P>To see what is coming out of the subsearch, and adjust it, run this...</P> <PRE><CODE>| inputlookup NamedDefinition.csv | table Indicator | format "(" "" "" "" "OR" ")" | rex mode=sed field=search "s/Indicator=//g" </CODE></PRE> Tue, 03 Oct 2017 16:18:37 GMT https://community.splunk.com/t5/Getting-Data-In/CSV-Searches/m-p/364835#M66458 DalJeanis 2017-10-03T16:18:37Z