Archive
Highlighted

data model and lookup table

New Member

How do I run my list of IOC from my lookup table against a web datamodel by using tstats.
I can do the regular IOC lookup table against the indexes and it work perfectly fine, however, it just take a lot of memory.
It would be help if some one knows how to run csv or kv to compare it with datamodel.

Tags (1)
0 Karma
Highlighted

Re: data model and lookup table

SplunkTrust
SplunkTrust

Could you give an example what you're already doing, your data, your lookup, your expected output, etc?

0 Karma
Highlighted

Re: data model and lookup table

New Member

for example here is a very basic search i am running
|tstats count from datamodel=Web by Web.url
| search
[| inputlookup http_intel
| fields url
| rename url as Web.url]

0 Karma
Highlighted

Re: data model and lookup table

Champion

Try this!

|tstats count from datamodel=Web where [| inputlookup http_intel.csv | fields url | rename url as Web.url]  by Web.url
0 Karma