CSV Searches

[rlamezquita]

Hello everyone. I've been reading and reading and I can not get consistent results from anything I have tried. So hopefully someone can help me get this straight. I have a csv as follows:

Indicator Type, Indicator, Description
domain, google.com, stuff
hash, asdfasdfdf4a6sd54fa6sd4fa6sd4f6sd, stuff
file, test.exe, stuff

I am trying to conduct a search that uses the Indicator column to search for ANY instances of the indicator. For example, it should return not just google.com, but also mail.google.com, or google.com.net. Additionally, I want to search the entire log, not just a specific field for that value. Here is what kinda works:

index=myindex | lookup NamedDefinition Indicator as logField OUTPUT Indicator as IOC | search IOC=* | stats count by IOC

That last part doesn't really matter, so it can be fields or whatever. This command works SOMETIMES. Sometimes I get errors that the lookup doesn't exist.

However, when it does work, this only searches one field in a log for something that matches in the csv EXACTLY. I tried putting a wildcard in the value (i.e. *google.com) but did not work. I also do not have access to modify any configuration files. I have also seen this command:

index=myindex [|inputlookup NamedDefinition.csv | fields Indicator]

but that has never returned any results. I know there are results (I use google.com as a control domain as well). Any help would be extremely appreciated.

[DalJeanis]

Try this ...

index=myindex 
[| inputlookup NamedDefinition.csv  | table Indicator  | format "(" "" "" "" "OR" ")"  | rex mode=sed field=search "s/Indicator=//g"]

To see what is coming out of the subsearch, and adjust it, run this...

| inputlookup NamedDefinition.csv  
| table Indicator  
| format "(" "" "" "" "OR" ")"  
| rex mode=sed field=search "s/Indicator=//g"