topic Re: Mass Searching for multiple domains in Splunk Search

Mass Searching for multiple domains

alexman616 — Mon, 08 Jun 2020 21:38:27 GMT

Hello!

I am trying to search for multiple malware domains in our logs. I cant figure out how to add multiple domains in my search.

Example:

"Bad Domains:"

go9ogle.com
265online.com
bofa2.com

How could I search all of the above domains at the same time?

Re: Mass Searching for multiple domains

cmerriman — Sat, 04 Apr 2020 01:14:11 GMT

My suggestion would be to create either a lookup table with the bad domains or a macro. this way you can just add [|inputlookup bad_domains.csv] to the search (for a lookup)

The lookup will work best if the field is extracted in the logs (for instance, a domain field, in which the lookup table has a domain column).

The macro would work if you're just doing keyword searches

Re: Mass Searching for multiple domains

to4kawa — Sat, 04 Apr 2020 03:03:15 GMT

"go9ogle.com" OR "265online.com" OR "bofa2.com"

see: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Search
and try https://www.splunk.com/en_us/training/courses/splunk-fundamentals-1.html

Re: Mass Searching for multiple domains

alexman616 — Sat, 04 Apr 2020 03:40:40 GMT

Thank you so much, we are looking at a list of almost 100,000 bad domains that have come out of this covid situation. I plan to break them up by 1,000 or 10,000... depending what splunk can take. Do you have any recommendations?

Re: Mass Searching for multiple domains

to4kawa — Sat, 04 Apr 2020 03:56:42 GMT

| makeresults
| eval domain=""
| append [| makeresults count=100000
| streamstats count as A
| eval domain="domain".A
| fields domain
| format]

Isn't it okay if you don't divide it?