Splunk Search

How come URLs in my lookup table are not working?


Greetings everyone!

I have a question concerning a CSV lookup table with domains in it, which sadly does not work.

To be more precise:

I got a lookup table I created with the Lookup editor with the following example entry and a single column called URL:


A simple | inputlookup file.csv will display that value correctly. If I try to use this list in a search though, it just ignores it.

Here is my example search:

index=dns NOT 
  [ | inputlookup file.csv
    | fields url ]

Is there any restriction in how an entry must be formatted to be accepted? *.trendmicro.com or trendmicro.com won't work either.

I just don't get what I am doing wrong since the contents of the file can be displayed.

Thanks alot! Help is much appreciated.

Best regards,


0 Karma

Ultra Champion

Personally I would reformat the CSV like this:

domain, ignore

In the lookup configuration, create a lookup definition and ensure wildcard matching is enabled (its not by default!)

then you can do:

"whatever your search providing a field called domain"|lookup ignored_domains domain OUTPUT ignore|where ignore!="true"
If my comment helps, please give it a thumbs up!
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...