for example, i have that log:
Apr 26 12:04:38 centos7LAB sudo: qweqwe : TTY=pts/4 ; PWD=/home/qweqwe ; USER=root ; COMMAND=/bin/chmod +x 436346
and i want to make filter by command by lookup
sourcetype=sudo | stats count by host _time src_user src TTY PWD USER dest COMMAND action | lookup suspicious_commands COMMAND AS COMMAND OUTPUT COMMAND AS COMMAND | where COMMAND!="" | sort - _time
match_type = WILDCARD(COMMAND)
my lookup look like it:
Open my screenshot and instead of
*chmod* I want see
/bin/chmod +x 436346
Or what you know other solutions to make what I want?
lookup suspicious_commands COMMAND OUTPUT COMMAND AS cmd_match | where isnotnull(cmd_match) | fields - cmd_match
If this isnt going to be a large lookup then yes the inputlookup pattern works. I tend to stick with the normal lookup pattern. Your original search stomped the original command field. This just outputs the field you matched on to it's own name then looks for where it is not null. AKA found a match.
Is the lookup only used as a list of things to search for? If yes, you can try using a query like this instead
sourcetype=sudo [| inputlookup suspicious_commands ] | stats count by host _time src_user src TTY PWD USER dest COMMAND action | sort - _time
So when a subsearch is used in a search command (and the search command is by default the first command of a query), the subsearch expands it's results into additional search terms, where the fields of a row/event are combined with "AND" and multiple rows/events are combined with "OR".
So if you have a lookup like
[| inputlookup suspicious_commands] will expand into
( (COMMAND="*chmod*") OR (COMMAND="*chown*") ).
You can actually see what exactly something would expand to by using the
format command, like
| inputlookup suspicious_commands| format. And you can use pretty much anything for the subsearch, not just lookups.