How do I create a more efficient search with wildcards with inputlookups in subseraches?

[Janani_Krish]

I have a lookup named tc with a field  indicator. I wanted to search that indicator field in my firewall sourcetype with wildcards as below.

[|inputlookup tc|dedup indicator|eval indicator1="*".indicator."*"|table indicator1|format] |where sourcetype="firewall"

But this search was not efficient and is time consuming. Also I was not able to use union or Join as I have to look for a field with wildcard.

Kindly suggest any alternatives.

[gcusello · Accepted solution]

Hi @Janani_Krish,

let me understand: do you want to perform a full text search using a field of your lookup on row events or you want to identify the matching values?

if the first, you could try something like this:

index=your_index sourcetype="firewall" [ | inputlookup tc | rename indicator AS query | fields query ] 
| table _time field1 field2 ...

Ciao.

Giuseppe

[Janani_Krish]

Hello @gcusello 

This searches the whole raw event. What if I wanted to search only the value of particular field in _raw ?

[gcusello]

Hi @Janani_Krish,

please see something like this (if the field to match is called "matching_field"):

index=your_index sourcetype="firewall" [ | inputlookup tc | eval matching_field="*".indicator."*" | fields matching_field ] 
| table _time matching_field field1 field2 ...

Ciao.

Giuseppe

[Janani_Krish]

Hello @gcusello 

Thanks for your reply. I wanted to find the matching values. But in this case,

My tc lookup will be having indicator="Michael" whereas my  firewall would have name= "Michael Jonas"

So I wanted to append wild card to my indicator field in lookup field and search as indicator=*Michael*. But since it is wildcard appended I was not able to do matching using join or union. Hence tried using text search method.

[gcusello]

Hi @Janani_Krish,

if you use my method (renaming your field in "query" in the lookup subsearch), you are performing a full text search on _row using the values of the renamed field, so you don't need to add wildcards.

Ciao.

Giuseppe

[Janani_Krish]

Thanks @gcusello . That works.