I have a lookup named tc with a field indicator. I wanted to search that indicator field in my firewall sourcetype with wildcards as below.
[|inputlookup tc|dedup indicator|eval indicator1="*".indicator."*"|table indicator1|format] |where sourcetype="firewall"
But this search was not efficient and is time consuming. Also I was not able to use union or Join as I have to look for a field with wildcard.
Kindly suggest any alternatives.
Hi @Janani_Krish,
let me understand: do you want to perform a full text search using a field of your lookup on row events or you want to identify the matching values?
if the first, you could try something like this:
index=your_index sourcetype="firewall" [ | inputlookup tc | rename indicator AS query | fields query ]
| table _time field1 field2 ...
Ciao.
Giuseppe
Hi @Janani_Krish,
let me understand: do you want to perform a full text search using a field of your lookup on row events or you want to identify the matching values?
if the first, you could try something like this:
index=your_index sourcetype="firewall" [ | inputlookup tc | rename indicator AS query | fields query ]
| table _time field1 field2 ...
Ciao.
Giuseppe
Hello @gcusello
This searches the whole raw event. What if I wanted to search only the value of particular field in _raw ?
Hi @Janani_Krish,
please see something like this (if the field to match is called "matching_field"):
index=your_index sourcetype="firewall" [ | inputlookup tc | eval matching_field="*".indicator."*" | fields matching_field ]
| table _time matching_field field1 field2 ...
Ciao.
Giuseppe
Hello @gcusello
Thanks for your reply. I wanted to find the matching values. But in this case,
My tc lookup will be having indicator="Michael" whereas my firewall would have name= "Michael Jonas"
So I wanted to append wild card to my indicator field in lookup field and search as indicator=*Michael*. But since it is wildcard appended I was not able to do matching using join or union. Hence tried using text search method.
Hi @Janani_Krish,
if you use my method (renaming your field in "query" in the lookup subsearch), you are performing a full text search on _row using the values of the renamed field, so you don't need to add wildcards.
Ciao.
Giuseppe
Thanks @gcusello . That works.