topic Re: Using multiple lookup tables in a query in Splunk Search

Using multiple lookup tables in a query

MM0071 — Thu, 16 Nov 2023 18:27:53 GMT

I don't think my search is doing what I want it to do. I would like to take the bad domains from the first lookup table and search the netlogs index to see if there are any hits. however, i would like to remove the good domains from the second lookup table from the search. Anyone know if there is a better way to do this?

Re: Using multiple lookup tables in a query

richgalloway — Thu, 16 Nov 2023 19:07:43 GMT

That can be accomplished with a single list by good list management. Anything on the baddomains list should not be in the gooddomains list and vice versa.

That said, what you have should work, but not as efficiently as a single list. A domain on both lists will not appear in the results, which is the intent.

For debugging purposes, run each subsearch on its own with | format appended to verify it returns the expected results. You may need to leave the format command in the final query, combined.

Re: Using multiple lookup tables in a query

gcusello — Fri, 17 Nov 2023 07:24:43 GMT

Hi @MM0071 ,

let me understand, you want to filter the results of the main search using the first lookup, already filtered suing the second one, is it correct?

If this is your requirement, my first hint is to run a search the filters the raws of the first lookup using the second on so you have to use only one lookup.

Anyway, if you want to use both the lookups in the same search, you can use your search and it should work fine

or use the second lookup in the first lookup subsearch:

or something similar.

Ciao.

Giuseppe