Splunk Search

Formatting Callout/Lookup Data to include non-exact matches. (Lookup/log/callout issue).

Explorer

Hi all,

Apologies for the vague title, I have a lookup problem that I need help with, so any help is greatly appreciated.

I have a .CSV file containing a single field named 'highriskkeywords' that I wish to use to help filter search results. My web filter logs are plugged into Splunk with SSL decrpytion enabled so I am able to pull out keywords from Google, Bing, Yahoo and YouTube using callouts

I'm currently using the following search to do this:

index=webfilter url="*bing*" [| inputlookup high_risk_words.csv | fields high_risk_words | rename high_risk_words as bing_callout | eval bing_callout="*"+bing_callout+"*"] | stats count by bing_callout, src, user | sort by -count

If the user searched the word 'Ferrari', I get results like:

ferrari
how+to+build+a+ferrari
ferarri%20
etc...

Instead of having 4 x search results with 1 x count, I would like to have 4 x hits for the word 'ferrari'. Is there a way to achieve this where the entry for 'ferrari' not only includes an exact match, that it also includes variations as shown above?

I've tried editing:

eval bing_callout="*"+bing_callout+"*"]

to 

eval bing_callout=bing_callout]

but this only includes exact matches for the word 'ferrari' and terms like 'how+to+build+a+ferarri' get missed.

I hope this all makes sense, any help would be really really appreciated!

Thank you 🙂

0 Karma