Splunk Search

How do I create a more efficient search with wildcards with inputlookups in subseraches?

Janani_Krish
Path Finder

I have a lookup named tc with a field  indicator. I wanted to search that indicator field in my firewall sourcetype with wildcards as below.

[|inputlookup tc|dedup indicator|eval indicator1="*".indicator."*"|table indicator1|format] |where sourcetype="firewall"



But this search was not efficient and is time consuming. Also I was not able to use union or Join as I have to look for a field with wildcard.

Kindly suggest any alternatives.

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Janani_Krish,

let me understand: do you want to perform a full text search using a field of your lookup on row events or you want to identify the matching values?

if the first, you could try something like this:

index=your_index sourcetype="firewall" [ | inputlookup tc | rename indicator AS query | fields query ] 
| table _time field1 field2 ...

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Janani_Krish,

let me understand: do you want to perform a full text search using a field of your lookup on row events or you want to identify the matching values?

if the first, you could try something like this:

index=your_index sourcetype="firewall" [ | inputlookup tc | rename indicator AS query | fields query ] 
| table _time field1 field2 ...

Ciao.

Giuseppe

Janani_Krish
Path Finder

Hello @gcusello 

This searches the whole raw event. What if I wanted to search only the value of particular field in _raw ?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Janani_Krish,

please see something like this (if the field to match is called "matching_field"):

index=your_index sourcetype="firewall" [ | inputlookup tc | eval matching_field="*".indicator."*" | fields matching_field ] 
| table _time matching_field field1 field2 ...

Ciao.

Giuseppe

0 Karma

Janani_Krish
Path Finder

Hello @gcusello 

Thanks for your reply. I wanted to find the matching values. But in this case,

My tc lookup will be having indicator="Michael" whereas my  firewall would have name= "Michael Jonas"

So I wanted to append wild card to my indicator field in lookup field and search as indicator=*Michael*. But since it is wildcard appended I was not able to do matching using join or union. Hence tried using text search method.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Janani_Krish,

if you use my method (renaming your field in "query" in the lookup subsearch), you are performing a full text search on _row using the values of the renamed field, so you don't need to add wildcards.

Ciao.

Giuseppe

 

Janani_Krish
Path Finder

Thanks @gcusello . That works.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...