https://community.splunk.com/t5/Splunk-Search/How-to-search-a-proxy-log-index-to-get-a-list-of-URLs-that-match/m-p/202246#M58654 <P>Actually I think I found it after testing.</P> <PRE><CODE>eventtype=cisco_wsa_squid [| inputlookup phishtank.csv | fields url] </CODE></PRE> <P>This appears to work for what I am looking for.</P> Tue, 01 Nov 2016 20:52:53 GMT pdumblet 2016-11-01T20:52:53Z https://community.splunk.com/t5/Splunk-Search/How-to-search-a-proxy-log-index-to-get-a-list-of-URLs-that-match/m-p/202245#M58653 <P>I have a proxy log index which contains a URL field. </P> <P>I also have a lookup table, which contains a list of known bad URLs.</P> <P>I would like to do a comparison to see if the indexed URL field has any values like those in the lookup table.</P> <P>Example: </P> <P>URL Field from Proxy Index:<BR /> url="<A href="http://www.somewebsite.com/cma-music-festival">http://www.somewebsite.com/cma-music-festival</A>"</P> <P>Lookup Table contains fields<BR /> category: Other<BR /> date: 2016-11-01T19:12:07+00:00<BR /> isbad: true<BR /><BR /> reference: <A href="http://www.phishtank.com/phish_detail.php?phish_id=4572548">http://www.phishtank.com/phish_detail.php?phish_id=4572548</A><BR /> url: <A href="http://somewebsite.com">http://somewebsite.com</A></P> <P>How would I search the proxy log index to get a list of the URLs that match those in the Lookup Table url field? </P> <P>Thanks.</P> Tue, 01 Nov 2016 20:48:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-a-proxy-log-index-to-get-a-list-of-URLs-that-match/m-p/202245#M58653 pdumblet 2016-11-01T20:48:08Z https://community.splunk.com/t5/Splunk-Search/How-to-search-a-proxy-log-index-to-get-a-list-of-URLs-that-match/m-p/202246#M58654 <P>Actually I think I found it after testing.</P> <PRE><CODE>eventtype=cisco_wsa_squid [| inputlookup phishtank.csv | fields url] </CODE></PRE> <P>This appears to work for what I am looking for.</P> Tue, 01 Nov 2016 20:52:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-a-proxy-log-index-to-get-a-list-of-URLs-that-match/m-p/202246#M58654 pdumblet 2016-11-01T20:52:53Z https://community.splunk.com/t5/Splunk-Search/How-to-search-a-proxy-log-index-to-get-a-list-of-URLs-that-match/m-p/202247#M58655 <P>@pdumblet - If this has provided a working solution, please click "Accept" below your answer to resolve your post. Otherwise, feel free to leave it open for now if you're open to other possible suggestions. Thanks.</P> Tue, 01 Nov 2016 21:44:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-a-proxy-log-index-to-get-a-list-of-URLs-that-match/m-p/202247#M58655 aaraneta_splunk 2016-11-01T21:44:07Z