Splunk Search

Blacklist lookup - search query

astackpole
Path Finder

I have a blacklist.csv file that looks like the following,

namedescription
*vpn*VPN was found.
*putty*Putty was found.

 

I'm trying this search and it's showing events match, but not outputting the name/description fields from the lookup.

index=os 
| lookup blacklist.csv name OUTPUT description 
| table name description

 

My goal is to search each event for every value in the name column, so the basic query I'm trying to match with the use of a lookup file is,

index=os
| search *vpn* OR *putty*

 

What lookup query do I need to implement this type of search and display the results?

Labels (1)
0 Karma

somesoni2
Revered Legend

The lookup table files (CSV lookup) doesn't support wildcard match on it's own. YOu've to create a lookup definition that supports wildcard match.  Have a look at this post for more details:

https://community.splunk.com/t5/Splunk-Search/Can-we-use-wildcard-characters-in-a-lookup-table/td-p/...

0 Karma

astackpole
Path Finder

What if there's no specific field I'm trying to search on?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...