https://community.splunk.com/t5/Splunk-Search/using-a-inputlookup-on-string-values-regex-match/m-p/54528#M13306 <P>I am currently matching a list of "bad ips" with a search such as this</P> <PRE><CODE>index=someindex NOT uri="/dot_clear.gif" [| inputlookup watchlist_ip_lookup.csv | rename watch_ip as clientip | fields + clientip] | dedup clientip | lookup ga ip as clientip | table date_month, date_mday, date_hour, date_minute, date_year, clientip, country, org, status, referer, uri, host, source, sourcetype, index, other </CODE></PRE> <P>how can i do a similar search with a partial text match in say the URI, say from sourcetype access_combined searching on a partial domain match like <CODE>.*somedomain.com.*</CODE> ?<BR /> I would like to use these domain strings in a inputlookup table like the ip list i attached above<BR /> possibly with a rex match on the uri? i am just not getting the format right.</P> <P>Thanks.</P> Fri, 07 Sep 2012 17:18:35 GMT sonicZ 2012-09-07T17:18:35Z https://community.splunk.com/t5/Splunk-Search/using-a-inputlookup-on-string-values-regex-match/m-p/54528#M13306 <P>I am currently matching a list of "bad ips" with a search such as this</P> <PRE><CODE>index=someindex NOT uri="/dot_clear.gif" [| inputlookup watchlist_ip_lookup.csv | rename watch_ip as clientip | fields + clientip] | dedup clientip | lookup ga ip as clientip | table date_month, date_mday, date_hour, date_minute, date_year, clientip, country, org, status, referer, uri, host, source, sourcetype, index, other </CODE></PRE> <P>how can i do a similar search with a partial text match in say the URI, say from sourcetype access_combined searching on a partial domain match like <CODE>.*somedomain.com.*</CODE> ?<BR /> I would like to use these domain strings in a inputlookup table like the ip list i attached above<BR /> possibly with a rex match on the uri? i am just not getting the format right.</P> <P>Thanks.</P> Fri, 07 Sep 2012 17:18:35 GMT https://community.splunk.com/t5/Splunk-Search/using-a-inputlookup-on-string-values-regex-match/m-p/54528#M13306 sonicZ 2012-09-07T17:18:35Z https://community.splunk.com/t5/Splunk-Search/using-a-inputlookup-on-string-values-regex-match/m-p/54529#M13307 <P>If it's just a matter of using wildcards, you can let the regular search command take care of that.</P> <PRE><CODE>index=someindex NOT [|inputlookup yourlookup | eval query="uri=*".domain."*" | fields query] | ... </CODE></PRE> Fri, 07 Sep 2012 21:15:40 GMT https://community.splunk.com/t5/Splunk-Search/using-a-inputlookup-on-string-values-regex-match/m-p/54529#M13307 Ayn 2012-09-07T21:15:40Z https://community.splunk.com/t5/Splunk-Search/using-a-inputlookup-on-string-values-regex-match/m-p/54530#M13308 <P>Thanks Ayn, i changed domain to my "watch_list" header in the csv and that works for me <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /> Edit: <BR /> actually i removed the NOT too, this and it seems to work</P> <P>index=someindex NOT uri="/dot_clear.gif" earliest=-1h [|inputlookup watchlist_string_lookup | eval query="uri=<EM>".watch_string."</EM>" | fields query] | lookup ga ip as clientip | table date_month, date_mday, date_hour, date_minute, date_year, clientip, country, org, status, referer, uri, host, source, sourcetype, index, other</P> Mon, 28 Sep 2020 12:24:20 GMT https://community.splunk.com/t5/Splunk-Search/using-a-inputlookup-on-string-values-regex-match/m-p/54530#M13308 sonicZ 2020-09-28T12:24:20Z https://community.splunk.com/t5/Splunk-Search/using-a-inputlookup-on-string-values-regex-match/m-p/54531#M13309 <P>Ayn, another follow up question <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /> If i wanted to match on a string anywhere in the _raw events, But seems rather slow on large indexes.<BR /> Perhaps there is a better way.</P> <P>index=www NOT uri="/dot_clear.gif" [|inputlookup watchlist_string_lookup | eval query="_raw=<EM>".watch_string."</EM>" | fields query] | lookup ga ip as clientip | table date_month, date_mday, date_hour, date_minute, date_year, clientip, country, org, status, referer, uri, host, source, sourcetype, index, other, watch_string</P> Mon, 28 Sep 2020 12:29:17 GMT https://community.splunk.com/t5/Splunk-Search/using-a-inputlookup-on-string-values-regex-match/m-p/54531#M13309 sonicZ 2020-09-28T12:29:17Z