How to use Lookup table to analyze events?

[waJesu]

I created a lookup table for blacklisted DNS queries. I need a query that uses the lookup table to see if domains in the lookup table are present in events in my environment. 

[richgalloway]

Assuming you have a "domain" field in both the lookup file and an index, this should get you started.

index=foo [ | inputlookup denieddomains.csv | field domain | format ]

The subsearch (inside square brackets) fetches the contents of the lookup table (I made up a name - replace it with your own), extracts only the "domain" field, then formats the results into a search string which is then returned to the main search for execution.

[waJesu]

I tried this and it did not return results.

[ITWhisperer]

This is a bit vague.

What fields and values do you have in your lookup table?

What corresponding fields do you have in your events?

[waJesu]

The lookup table has a single field "DNS" with all the blocklisted dns requests e.g. bliss.com, sugar.plux.net etc.. The corresponding field in the events could be dns_queries

[waJesu]

I meant dns_query

[ITWhisperer]

index=foo [ | inputlookup denieddomains.csv | field DNS | rename DNS as dns_query | format ]

[waJesu]

It worked. Thank you very much. May you please explain to me what each part of the query does so that next time I can create personal queries of the same kind.

[ITWhisperer]

The subsearch retrieves the DNS names from the lookup and renames the field so that it matches the field name used in the events. The format essentially expands to something like this 

index=foo (( dns_query="value1") OR (dns_query="value2"))

[waJesu]

Thank you. I really appreciate.