How to incorporate a lookup in search but with wild card?

[intrach]

Hello all,

I have a lookup table which contains a list of URL we want to search in splunk, but instead of searching the specific URL in the list, we want to search when it contains a string in that URL.

example:

in the lookup we have a URL:
blog.example.com

I also want it to search and find URL which contains "blog.example.com". In the search it should be url=*blog.example.com, but how can I apply this search characteristic when using a lookup.

Thanks for any help.

[intrach]

Thanks2x...it was the url field name being Url...thanks so much..you're a legend!

[intrach]

Hi Giuseppe,

Sorry, i am relatively new at this. So my lookup file name is Sus_url.csv and I have a column name of url in the lookup which contains the list.

so I input:
index=dns_file
[ |inputlookup Sus_url.csv | rename url AS query | fields query ]
| ...

but it is giving me an error 

[ITWhisperer]

What error is it giving?

[gcusello · Accepted solution]

Hi @intrach,

which error are you receiving?

anyway, did you creted the lookup definition for your lookup?

are your sure about the "url" fieldname (it's case sensitive)?

the search seems to be correct:

index=dns_file [ | inputlookup Sus_url.csv | rename url AS query | fields query ]

Ciao.

Giuseppe

[gcusello]

Hi @intrach,

could you please try something like this?

index=your_index [ | inputlookup | rename url AS query | fields query ]
| ...

in this way you perform a free text search using the content of the lookup's url field.

Ciao.

Giuseppe