How to lookup value with wildcard?

[test_qweqwe]

Hi.
for example, i have that log:
Apr 26 12:04:38 centos7LAB sudo: qweqwe : TTY=pts/4 ; PWD=/home/qweqwe ; USER=root ; COMMAND=/bin/chmod +x 436346
and i want to make filter by command by lookup
kinda sourcetype=sudo | stats count by host _time src_user src TTY PWD USER dest COMMAND action | lookup suspicious_commands COMMAND AS COMMAND OUTPUT COMMAND AS COMMAND | where COMMAND!="" | sort - _time

I used match_type = WILDCARD(COMMAND)

my lookup look like it:

COMMAND
*chmod*

Open my screenshot and instead of *chmod* I want see /bin/chmod +x 436346

Or what you know other solutions to make what I want?

[janispelss · Accepted solution]

Is the lookup only used as a list of things to search for? If yes, you can try using a query like this instead
sourcetype=sudo [| inputlookup suspicious_commands ] | stats count by host _time src_user src TTY PWD USER dest COMMAND action | sort - _time

[test_qweqwe]

It works! Thank you!
Will be nice if you will explain a bit why it works, cause i have some triggers in my head.

[janispelss]

So when a subsearch is used in a search command (and the search command is by default the first command of a query), the subsearch expands it's results into additional search terms, where the fields of a row/event are combined with "AND" and multiple rows/events are combined with "OR".

So if you have a lookup like
COMMAND
*chmod*
*chown*

then [| inputlookup suspicious_commands] will expand into ( (COMMAND="*chmod*") OR (COMMAND="*chown*") ).

You can actually see what exactly something would expand to by using the format command, like | inputlookup suspicious_commands| format. And you can use pretty much anything for the subsearch, not just lookups.

[starcher]

Do
lookup suspicious_commands COMMAND OUTPUT COMMAND AS cmd_match | where isnotnull(cmd_match) | fields - cmd_match

[test_qweqwe]

It works, too!
Explain me what you did.
I mean:
lookup suspicious_commands COMMAND OUTPUT COMMAND AS cmd_match

[starcher]

If this isnt going to be a large lookup then yes the inputlookup pattern works. I tend to stick with the normal lookup pattern. Your original search stomped the original command field. This just outputs the field you matched on to it's own name then looks for where it is not null. AKA found a match.