https://community.splunk.com/t5/Splunk-Search/How-to-search-using-a-list-as-input/m-p/47263#M11281 <P>I have a list of domain names in an input file. I have a log source with a bunch of dns logs. I want to return any logs tha have even a partial match of the dns names.</P> <P>So dns.txt has:</P> <P>blah.com<BR /> lol.com<BR /> ...</P> <P>And my log source has a field called "hostname" that might be like "toad.blah.com". If blah.com from dns.txt matches as a substring in the hostname field, then I want to see that log in my result set.</P> <P>Thanks!</P> Wed, 09 May 2012 17:34:56 GMT four 2012-05-09T17:34:56Z https://community.splunk.com/t5/Splunk-Search/How-to-search-using-a-list-as-input/m-p/47263#M11281 <P>I have a list of domain names in an input file. I have a log source with a bunch of dns logs. I want to return any logs tha have even a partial match of the dns names.</P> <P>So dns.txt has:</P> <P>blah.com<BR /> lol.com<BR /> ...</P> <P>And my log source has a field called "hostname" that might be like "toad.blah.com". If blah.com from dns.txt matches as a substring in the hostname field, then I want to see that log in my result set.</P> <P>Thanks!</P> Wed, 09 May 2012 17:34:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-using-a-list-as-input/m-p/47263#M11281 four 2012-05-09T17:34:56Z https://community.splunk.com/t5/Splunk-Search/How-to-search-using-a-list-as-input/m-p/47264#M11282 <P>You'd do something like this...</P> <PRE><CODE>index=*whatever* [inputlookup dns.txt.csv | fields hostname | rename hostname as search] </CODE></PRE> <P>Your .csv file has to be in a 'lookups' directory in either the parent or a child local directory - like /opt/splunk/etc/apps/search/lookups. (I've only used .csv files - not sure .txt would work)</P> <P>In this case, dns.txt.csv is a single-column csv with hostname (being the column name, etc) as the first value and the domains to be searched as the subsequent lines. The 'rename fields as search' means it'll return more than just 1:1 value matches - ex: blah.com will match when hostname=toad.blah.com <EM>and</EM> when hostname=blah.com instead of just the latter.</P> Wed, 09 May 2012 18:00:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-using-a-list-as-input/m-p/47264#M11282 rgonzale6 2012-05-09T18:00:38Z https://community.splunk.com/t5/Splunk-Search/How-to-search-using-a-list-as-input/m-p/47265#M11283 <P>I think this is similar to what you are trying to do and should help get you there. Your file would look like this with dns_name or whatever you call it as the header.</P> <P>dns_name<BR /> blah.com<BR /> lol.com</P> <P><A href="http://splunk-base.splunk.com/answers/2457/inputlookup-against-a-list-of-bad-domains">http://splunk-base.splunk.com/answers/2457/inputlookup-against-a-list-of-bad-domains</A></P> Wed, 09 May 2012 18:00:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-using-a-list-as-input/m-p/47265#M11283 sdaniels 2012-05-09T18:00:55Z