Can you help me with a lookuptable question?

[adabud6267]

Hello all,

I have indexed data that contains an extracted field (domain) and a CSV (https.csv) file with the following headers URL,IP,Location_Code,Location_Name. I'd like to return ONLY events that concern the domains in the CSV files.

| lookup https URL as domain OUTPUT IP, Location_Code, Location_Name 

Would the above return only the events where the domain fields values match the values under the URL header in my CSV file?

Thank you!

[gcusello · Accepted solution]

Hi adabud6267,
try something like this:

index=domain [ | inputlookup https | rename URL as domain | fields domain ]
| ...

beware that the field name (domain) must be the same in main search and subsearch.

If you want to run the search with a substring of URL field, you have to extract it using substr function or a regex.

Bye.
Giuseppe

[adabud6267]

Hello @cusello

Thank you for your answer! It works. Please tell me on thing.

will www.domain-foo.com match domain-foo.com ?

Also it appears, that I cannot use the fields from the csv file as I would do it with the lookup command. I'd like to add a column containing the city code from the CSV file if a domain match is found.

Thank you and I appreciate your help !

[gcusello]

To match a substring, you can use "*" at the beginning and the end of the string in you search.
Otherwise, in you search you can use

index=domain [ | inputlookup https | rename URL as query | fields query ]
| ...

Bye.
Giuseppe

[richgalloway]

@adabud6267 If your problem is resolved, please accept the answer to help future readers.