topic Re: How to lookup value with wildcard? in Splunk Search

How to lookup value with wildcard?

test_qweqwe — Thu, 26 Apr 2018 10:44:20 GMT

Hi.
for example, i have that log:
Apr 26 12:04:38 centos7LAB sudo: qweqwe : TTY=pts/4 ; PWD=/home/qweqwe ; USER=root ; COMMAND=/bin/chmod +x 436346
and i want to make filter by command by lookup
kinda sourcetype=sudo | stats count by host _time src_user src TTY PWD USER dest COMMAND action | lookup suspicious_commands COMMAND AS COMMAND OUTPUT COMMAND AS COMMAND | where COMMAND!="" | sort - _time

I used match_type = WILDCARD(COMMAND)

my lookup look like it:

COMMAND
*chmod*

Open my screenshot and instead of *chmod* I want see /bin/chmod +x 436346

Or what you know other solutions to make what I want?

Re: How to lookup value with wildcard?

starcher — Thu, 26 Apr 2018 12:41:53 GMT

Do
lookup suspicious_commands COMMAND OUTPUT COMMAND AS cmd_match | where isnotnull(cmd_match) | fields - cmd_match

Re: How to lookup value with wildcard?

janispelss — Thu, 26 Apr 2018 13:32:16 GMT

Is the lookup only used as a list of things to search for? If yes, you can try using a query like this instead
sourcetype=sudo [| inputlookup suspicious_commands ] | stats count by host _time src_user src TTY PWD USER dest COMMAND action | sort - _time

Re: How to lookup value with wildcard?

test_qweqwe — Tue, 29 Sep 2020 19:16:24 GMT

It works, too!
Explain me what you did.
I mean:
lookup suspicious_commands COMMAND OUTPUT COMMAND AS cmd_match

Re: How to lookup value with wildcard?

test_qweqwe — Thu, 26 Apr 2018 14:34:23 GMT

It works! Thank you!
Will be nice if you will explain a bit why it works, cause i have some triggers in my head.

Re: How to lookup value with wildcard?

starcher — Thu, 26 Apr 2018 19:12:46 GMT

If this isnt going to be a large lookup then yes the inputlookup pattern works. I tend to stick with the normal lookup pattern. Your original search stomped the original command field. This just outputs the field you matched on to it's own name then looks for where it is not null. AKA found a match.

Re: How to lookup value with wildcard?

janispelss — Fri, 27 Apr 2018 05:46:57 GMT

So when a subsearch is used in a search command (and the search command is by default the first command of a query), the subsearch expands it's results into additional search terms, where the fields of a row/event are combined with "AND" and multiple rows/events are combined with "OR".

So if you have a lookup like
COMMAND
*chmod*
*chown*

then [| inputlookup suspicious_commands] will expand into ( (COMMAND="*chmod*") OR (COMMAND="*chown*") ).

You can actually see what exactly something would expand to by using the format command, like | inputlookup suspicious_commands| format. And you can use pretty much anything for the subsearch, not just lookups.