topic Search domain in lookup in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/Search-domain-in-lookup/m-p/696099#M12034 <P>I have lookup file bad_domain.csv</P><TABLE border="0" width="64" cellspacing="0" cellpadding="0"><COLGROUP><COL width="64" /></COLGROUP><TBODY><TR><TD width="64" height="20">baddomain.com</TD></TR><TR><TD height="20">baddomain2.com</TD></TR><TR><TD height="20"><P>baddomain3.com</P></TD></TR></TBODY></TABLE><P>&nbsp;</P><P>Then i want to search from proxy log, who people connect to bad domains in my lookup list. But include subdomains.<BR /><BR />Example:<BR /><BR />subdo1.baddomain.com<BR />subdo2.baddomain.com<BR />subdo1.baddomain2.com<BR /><BR />Please help, how to create that condition in spl query?</P> Tue, 13 Aug 2024 07:03:23 GMT f_666dhn 2024-08-13T07:03:23Z Search domain in lookup https://community.splunk.com/t5/Splunk-Enterprise-Security/Search-domain-in-lookup/m-p/696099#M12034 <P>I have lookup file bad_domain.csv</P><TABLE border="0" width="64" cellspacing="0" cellpadding="0"><COLGROUP><COL width="64" /></COLGROUP><TBODY><TR><TD width="64" height="20">baddomain.com</TD></TR><TR><TD height="20">baddomain2.com</TD></TR><TR><TD height="20"><P>baddomain3.com</P></TD></TR></TBODY></TABLE><P>&nbsp;</P><P>Then i want to search from proxy log, who people connect to bad domains in my lookup list. But include subdomains.<BR /><BR />Example:<BR /><BR />subdo1.baddomain.com<BR />subdo2.baddomain.com<BR />subdo1.baddomain2.com<BR /><BR />Please help, how to create that condition in spl query?</P> Tue, 13 Aug 2024 07:03:23 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Search-domain-in-lookup/m-p/696099#M12034 f_666dhn 2024-08-13T07:03:23Z Re: Search domain in lookup https://community.splunk.com/t5/Splunk-Enterprise-Security/Search-domain-in-lookup/m-p/696101#M12035 <P>Change your lookup to have * at the beginning e.g. *baddomain.com then change / create the definition for the lookup to do WILDCARD searches</P> Tue, 13 Aug 2024 07:44:51 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Search-domain-in-lookup/m-p/696101#M12035 ITWhisperer 2024-08-13T07:44:51Z