Splunk Search

Compare main search field contain value of another field value stored in lookup table

rameshpillai
New Member

I would like to compare(not exact match) urls in my proxy log with url stored in lookup table

Eg for URL in proxy log

P1:  99.99.99.99/safebrowse/jh/oiruitupwerouitufkgjlhsfghjdfsglhjpoier/AFHJDFHADS?S=32

----------------------------------------------------------------------------

Eg for URL's in loookup file

L1:  99.99.99.99/safebrowse/jh/oiruitupwerouitufkgjlhsfghjdfsglhjpoier

L2:  88.99.77.66/query.js

L3:  www.notaurl.com/8484/ucd/94843984.php 

Tried to use inputlookup in subsearch and join , however it fails to match , as in either case (subsearch or join) splunk does an exact match

sample subsearch query

|tstats count from datamodel=Web where Web.user!="-" by Web.user Web.url _time
| search [|inputlookup url_lookup | search type="URL" | fields ref_url | rename ref_url as Web.Url]
|table Web.user Web.url _time count

i want help where in P1 should match L1

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The first step is to create lookup definitions which have WILDCARD(URL) set.  Then append a "*" to the URLs.  That should resolve the matching problem.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...