data model and lookup table

New Member

How do I run my list of IOC from my lookup table against a web datamodel by using tstats.
I can do the regular IOC lookup table against the indexes and it work perfectly fine, however, it just take a lot of memory.
It would be help if some one knows how to run csv or kv to compare it with datamodel.

Tags (1)
0 Karma


Try this!

|tstats count from datamodel=Web where [| inputlookup http_intel.csv | fields url | rename url as Web.url]  by Web.url
0 Karma


Could you give an example what you're already doing, your data, your lookup, your expected output, etc?

0 Karma

New Member

for example here is a very basic search i am running
|tstats count from datamodel=Web by Web.url
| search
[| inputlookup http_intel
| fields url
| rename url as Web.url]

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!