Splunk Search

How to edit my lookup search to display multiple fields after matching domains in a CSV file?

packet_hunter
Contributor

Scenario: I am matching dns queries to the domains listed in malware_domainsdm.csv. The .csv has multiple fields that I want to display after it matches the dns query domain to the malware domains.

Here is the search I am currently using, it displays the all .csv fields (column headers) but no values.

index=DNSlogs | eval reformattedDomain = replace(replace(questionname,"\(\d+\)","."),"\.(.*)\.","\1")
| stats count by reformattedDomain 
| lookup malware_domainsdm.csv domain AS reformattedDomain  
| eval domainmatch=if(reformatedDomain==domain, "bad", "good")

Please provide an example, thank you

Tags (1)
0 Karma
1 Solution

ryandg
Communicator

You mean something like

 |lookup malware_domainsdm.csv domain AS reformattedDomain  OUTPUT FieldX FieldY FieldZ

Not quite what else you are asking for but the lookup command without OUTPUT should already output all fields by default.

View solution in original post

0 Karma

ryandg
Communicator

You mean something like

 |lookup malware_domainsdm.csv domain AS reformattedDomain  OUTPUT FieldX FieldY FieldZ

Not quite what else you are asking for but the lookup command without OUTPUT should already output all fields by default.

0 Karma

packet_hunter
Contributor

Hi Ryan, you are correct with your answer and I apologize for the confusion on this question. I did not properly test a matching condition. When a matching condition occurs all fields populate. Thank you for your help.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...