https://community.splunk.com/t5/Splunk-Enterprise-Security/Wildcard-for-domain-search/m-p/452521#M6312 <P>I am trying to find the domain that came in the logs but were faked to look similar for our domain.<BR /> So if my domain is abc.co I would like to list all entries that came for abc.co.xyz.com, abc.co.aaa.com, etc.<BR /> Thanks!</P> Fri, 10 May 2019 10:29:10 GMT johnde 2019-05-10T10:29:10Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Wildcard-for-domain-search/m-p/452521#M6312 <P>I am trying to find the domain that came in the logs but were faked to look similar for our domain.<BR /> So if my domain is abc.co I would like to list all entries that came for abc.co.xyz.com, abc.co.aaa.com, etc.<BR /> Thanks!</P> Fri, 10 May 2019 10:29:10 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Wildcard-for-domain-search/m-p/452521#M6312 johnde 2019-05-10T10:29:10Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Wildcard-for-domain-search/m-p/452522#M6313 <P>Please provide sample data for this. You can write the SPL in 1000's of ways if you don't provide sample data</P> Fri, 10 May 2019 14:20:01 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Wildcard-for-domain-search/m-p/452522#M6313 koshyk 2019-05-10T14:20:01Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Wildcard-for-domain-search/m-p/452523#M6314 <P>Thanks for the reply @koshyk .<BR /> I am new to SPL and still trying to figure out the right approach, what I am trying to find out is if someone faked our login page and redirected a user when they login with their credentials to our page.<BR /> Let's say our login page is is login.mydomain.co and someone created a sub-domain with our login page name, login.mydomain.co.fakedomain.com and this looks similar to our login page. Once a user enters the username password they are redirected to mydomain.co. I wanted to see if any of our users clicked on that link and entered the credentials based on the redirect.<BR /> fakedomain.com is not constant and it can be any value.</P> Fri, 10 May 2019 14:48:24 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Wildcard-for-domain-search/m-p/452523#M6314 johnde 2019-05-10T14:48:24Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Wildcard-for-domain-search/m-p/452524#M6315 <P>Can't you just do <CODE>myfield=abc.co*</CODE>? Also, check out this app:<BR /> <A href="https://splunkbase.splunk.com/app/3376/">https://splunkbase.splunk.com/app/3376/</A></P> Fri, 10 May 2019 18:09:07 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Wildcard-for-domain-search/m-p/452524#M6315 woodcock 2019-05-10T18:09:07Z