How to correlate logs with different sources to detect events

[syh]

Hi, what I am trying to do is to create a search query based on two sources.
Source 1 will be the logs I want to investigate in. Source 2 will be a list of malicious domains I want to compare Source 1 with. (Source 2 could also be a csv file I obtained online).
The result I want will be that I am able to detect malicious domains which maybe in source 1, based on data in source 2 (I hope I'm making sense).

I'm new to Splunk so any help will be greatly appreciated. Thank you.

[woodcock]

Make/keep it a lookup like this:

index=YouShouldAlwaysSpecifyAnIndex ... | lookup YourThreatLookupFileHere.csv YourKeyFieldNameInLookup AS YourKeyFieldNameInEvents

This will pull in all the other fields from the CSV and attach them to the appropriate events.

[syh]

Ok, then where in the query should I add my source1?

[renjith_nair]

Hi @syh,

You could do it multiple ways using join , subsearch etc . However easiest way is to use stats something similar to

index="your index" (source="source1" OR source="source2") 
|stats dc(source) as presence, values(*) as * by domains|where presence>1