How to search for blocked dns/urls in my logs?

[waJesu]

I have created a lookup table for the blocked dns/url. I want to see if there are anywhere in my logs or in my environment. May you help with a query. For example if I have example.net on my lookup table what query can I use that returns all logs with example.net?

[inventsekar]

Hi @waJesu ...

Considering your lookup file name as "yourfilename.csv", when you run this, do you get the whole lookup file?
| inputcsv yourfilename.csv

may i know if you have done this task - enriching data with a CSV lookup file link

[waJesu]

Yes it returns the whole table. What I need now is the query that returns results if any of the contains of the lookup table is present in the logs.

[inventsekar]

Hi @waJesu 

you should give us some sample logs and the lookup table few lines sample.. then only SPL can be created easily.