Splunk Search

How do I create a more efficient search with wildcards with inputlookups in subseraches?

Janani_Krish
Path Finder

I have a lookup named tc with a field  indicator. I wanted to search that indicator field in my firewall sourcetype with wildcards as below.

[|inputlookup tc|dedup indicator|eval indicator1="*".indicator."*"|table indicator1|format] |where sourcetype="firewall"



But this search was not efficient and is time consuming. Also I was not able to use union or Join as I have to look for a field with wildcard.

Kindly suggest any alternatives.

Labels (2)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @Janani_Krish,

let me understand: do you want to perform a full text search using a field of your lookup on row events or you want to identify the matching values?

if the first, you could try something like this:

index=your_index sourcetype="firewall" [ | inputlookup tc | rename indicator AS query | fields query ] 
| table _time field1 field2 ...

Ciao.

Giuseppe

View solution in original post

gcusello
Esteemed Legend

Hi @Janani_Krish,

let me understand: do you want to perform a full text search using a field of your lookup on row events or you want to identify the matching values?

if the first, you could try something like this:

index=your_index sourcetype="firewall" [ | inputlookup tc | rename indicator AS query | fields query ] 
| table _time field1 field2 ...

Ciao.

Giuseppe

Janani_Krish
Path Finder

Hello @gcusello 

This searches the whole raw event. What if I wanted to search only the value of particular field in _raw ?

0 Karma

gcusello
Esteemed Legend

Hi @Janani_Krish,

please see something like this (if the field to match is called "matching_field"):

index=your_index sourcetype="firewall" [ | inputlookup tc | eval matching_field="*".indicator."*" | fields matching_field ] 
| table _time matching_field field1 field2 ...

Ciao.

Giuseppe

0 Karma

Janani_Krish
Path Finder

Hello @gcusello 

Thanks for your reply. I wanted to find the matching values. But in this case,

My tc lookup will be having indicator="Michael" whereas my  firewall would have name= "Michael Jonas"

So I wanted to append wild card to my indicator field in lookup field and search as indicator=*Michael*. But since it is wildcard appended I was not able to do matching using join or union. Hence tried using text search method.

0 Karma

gcusello
Esteemed Legend

Hi @Janani_Krish,

if you use my method (renaming your field in "query" in the lookup subsearch), you are performing a full text search on _row using the values of the renamed field, so you don't need to add wildcards.

Ciao.

Giuseppe

 

Janani_Krish
Path Finder

Thanks @gcusello . That works.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...