I am trying to conduct a search that uses the Indicator column to search for ANY instances of the indicator. For example, it should return not just google.com, but also mail.google.com, or google.com.net. Additionally, I want to search the entire log, not just a specific field for that value. Here is what kinda works:
index=myindex | lookup NamedDefinition Indicator as logField OUTPUT Indicator as IOC | search IOC=* | stats count by IOC
That last part doesn't really matter, so it can be fields or whatever. This command works SOMETIMES. Sometimes I get errors that the lookup doesn't exist.
However, when it does work, this only searches one field in a log for something that matches in the csv EXACTLY. I tried putting a wildcard in the value (i.e. *google.com) but did not work. I also do not have access to modify any configuration files. I have also seen this command: