https://community.splunk.com/t5/Splunk-Search/how-to-use-lookups-to-compare-a-csv-against-indexed-DNS-data/m-p/152127#M42634 <P>You can configure match_type=WILDCARD(domain) in transforms.conf for your lookup file.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Addfieldsfromexternaldatasources#Optional_field_matching_rules_for_lookup_configurations">http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Addfieldsfromexternaldatasources#Optional_field_matching_rules_for_lookup_configurations</A></P> <P>Note that your lookup file would need to have a wildcard, so your file would look like:</P> <PRE><CODE>domain,dyns_dns_servcice (csv header) *3322.org, true (values) </CODE></PRE> Fri, 27 Feb 2015 03:02:28 GMT the_wolverine 2015-02-27T03:02:28Z https://community.splunk.com/t5/Splunk-Search/how-to-use-lookups-to-compare-a-csv-against-indexed-DNS-data/m-p/152126#M42633 <P>I am ingesting DNS records into my splunk system. I want to compare these events again a list of Dynamic DNS domains. I've been able to incorporate the CSV of dynamics DNS into Splunk, but when I search I am only finding values that equal the domain, not values that "contain" the domain.</P> <P>example events: (dns field is called "domain" in my splunk instance)<BR /> 3322.org<BR /> test.3322.org</P> <P>CSV file format: (called "dynamic_dns")<BR /> domain,dyns_dns_servcice (csv header)<BR /> 3322.org, true (values)</P> <P>Here's the Splunk query I used:<BR /> sourcetype="dns" | lookup dynamic_dns domain | search dyn_dns_service=true</P> <P>This splunk query returns results for "3322.org", but not the other domain "test.3322.org". </P> <P>What would be a query to run that would capture both domains? I can't figure out the correct search syntax.</P> <P>Any help is greatly appreciated. Thank you</P> Mon, 28 Sep 2020 19:00:48 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-lookups-to-compare-a-csv-against-indexed-DNS-data/m-p/152126#M42633 vitalechris15 2020-09-28T19:00:48Z https://community.splunk.com/t5/Splunk-Search/how-to-use-lookups-to-compare-a-csv-against-indexed-DNS-data/m-p/152127#M42634 <P>You can configure match_type=WILDCARD(domain) in transforms.conf for your lookup file.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Addfieldsfromexternaldatasources#Optional_field_matching_rules_for_lookup_configurations">http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Addfieldsfromexternaldatasources#Optional_field_matching_rules_for_lookup_configurations</A></P> <P>Note that your lookup file would need to have a wildcard, so your file would look like:</P> <PRE><CODE>domain,dyns_dns_servcice (csv header) *3322.org, true (values) </CODE></PRE> Fri, 27 Feb 2015 03:02:28 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-lookups-to-compare-a-csv-against-indexed-DNS-data/m-p/152127#M42634 the_wolverine 2015-02-27T03:02:28Z