Splunk Search

How do I use inputlookup to search a list of domains?

digital_alchemy
Path Finder

I have a .csv list of domains I would like to search and I've uploaded it as a lookup table file.

The table is formated with a header of domain as:

test_domains
msn.com
google.com
yahoo.com

My searchs are:

*[|inputlookup test_domains.csv]
*[|inputlookup test_domains.csv | rename test_domains as domain | fields + domain]

The search completes with 0 results even though if I search for the domains indivdually there is definite activity to those test domains.

I'm can't figure out why i'm not gettting results when using inputlookup.

Any ideas or pointers?

Thanks

Tags (2)
0 Karma
1 Solution

digital_alchemy
Path Finder

Ok... I figured it out.

Our Splunk config doesn't contain an extraction for the field "domain" so I had to rename the domain field to field we use for domains.

View solution in original post

0 Karma

digital_alchemy
Path Finder

Ok... I figured it out.

Our Splunk config doesn't contain an extraction for the field "domain" so I had to rename the domain field to field we use for domains.

View solution in original post

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!