Search domain in lookup

[f_666dhn]

I have lookup file bad_domain.csv

baddomain.com

baddomain2.com

baddomain3.com

Then i want to search from proxy log, who people connect to bad domains in my lookup list. But include subdomains.

Example:

subdo1.baddomain.com
subdo2.baddomain.com
subdo1.baddomain2.com

Please help, how to create that condition in spl query?

[ITWhisperer]

Change your lookup to have * at the beginning e.g. *baddomain.com then change / create the definition for the lookup to do WILDCARD searches