https://community.splunk.com/t5/Splunk-Search/how-to-search-for-event-matching-lookup-table/m-p/587129#M204480 <P>What field or fields are you using from your index to lookup data in your lookup table?</P> Wed, 02 Mar 2022 07:46:24 GMT ITWhisperer 2022-03-02T07:46:24Z https://community.splunk.com/t5/Splunk-Search/how-to-search-for-event-matching-lookup-table/m-p/587125#M204478 <P>hi, i a total newbie</P><P>i need to do a search in splunk matching the domain in my lookup table (master_lookup.csv)</P><P>my table have the columns</P><P>indicators, published_date , last_update, labels</P><P>my index is below</P><P>((index=bcoat_logs AND sourcetype=bluecoat:proxysg:access:file ) OR (index=nanolog_906062_zscaler AND sourcetype=zscalernss-web))</P><P>how do i have the output when it match the indicators</P><P>my desired output will include<BR />_time,&nbsp;indicators, published_date , last_update, labels</P> Wed, 02 Mar 2022 07:07:32 GMT https://community.splunk.com/t5/Splunk-Search/how-to-search-for-event-matching-lookup-table/m-p/587125#M204478 7ryota 2022-03-02T07:07:32Z https://community.splunk.com/t5/Splunk-Search/how-to-search-for-event-matching-lookup-table/m-p/587129#M204480 <P>What field or fields are you using from your index to lookup data in your lookup table?</P> Wed, 02 Mar 2022 07:46:24 GMT https://community.splunk.com/t5/Splunk-Search/how-to-search-for-event-matching-lookup-table/m-p/587129#M204480 ITWhisperer 2022-03-02T07:46:24Z https://community.splunk.com/t5/Splunk-Search/how-to-search-for-event-matching-lookup-table/m-p/587131#M204482 <P>indicators</P><P>&nbsp;</P> Wed, 02 Mar 2022 07:50:50 GMT https://community.splunk.com/t5/Splunk-Search/how-to-search-for-event-matching-lookup-table/m-p/587131#M204482 7ryota 2022-03-02T07:50:50Z https://community.splunk.com/t5/Splunk-Search/how-to-search-for-event-matching-lookup-table/m-p/587132#M204483 <LI-CODE lang="markup">((index=bcoat_logs AND sourcetype=bluecoat:proxysg:access:file ) OR (index=nanolog_906062_zscaler AND sourcetype=zscalernss-web)) | lookup master_lookup.csv indicators | table _time, indicators, published_date , last_update, labels</LI-CODE> Wed, 02 Mar 2022 07:55:24 GMT https://community.splunk.com/t5/Splunk-Search/how-to-search-for-event-matching-lookup-table/m-p/587132#M204483 ITWhisperer 2022-03-02T07:55:24Z https://community.splunk.com/t5/Splunk-Search/how-to-search-for-event-matching-lookup-table/m-p/587143#M204489 <P>the indicator is extract match?</P><P>connect.facebook.net is inside my csv file</P><P>will it be a able to search for facebook.net</P> Wed, 02 Mar 2022 08:46:17 GMT https://community.splunk.com/t5/Splunk-Search/how-to-search-for-event-matching-lookup-table/m-p/587143#M204489 7ryota 2022-03-02T08:46:17Z https://community.splunk.com/t5/Splunk-Search/how-to-search-for-event-matching-lookup-table/m-p/587146#M204490 <P>It depends on your lookup definition - there are some advanced options available</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="ITWhisperer_0-1646211104242.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/18197i7AD3ADB5B636CFA4/image-size/medium?v=v2&amp;px=400" role="button" title="ITWhisperer_0-1646211104242.png" alt="ITWhisperer_0-1646211104242.png" /></span></P><P>&nbsp;</P> Wed, 02 Mar 2022 08:51:52 GMT https://community.splunk.com/t5/Splunk-Search/how-to-search-for-event-matching-lookup-table/m-p/587146#M204490 ITWhisperer 2022-03-02T08:51:52Z