Hi, what I am trying to do is to create a search query based on two sources.
Source 1 will be the logs I want to investigate in. Source 2 will be a list of malicious domains I want to compare Source 1 with. (Source 2 could also be a csv file I obtained online).
The result I want will be that I am able to detect malicious domains which maybe in source 1, based on data in source 2 (I hope I'm making sense).
I'm new to Splunk so any help will be greatly appreciated. Thank you.
Make/keep it a lookup like this:
index=YouShouldAlwaysSpecifyAnIndex ... | lookup YourThreatLookupFileHere.csv YourKeyFieldNameInLookup AS YourKeyFieldNameInEvents
This will pull in all the other fields from the CSV and attach them to the appropriate events.
You could do it multiple ways using
subsearch etc . However easiest way is to use
stats something similar to
index="your index" (source="source1" OR source="source2") |stats dc(source) as presence, values(*) as * by domains|where presence>1