Splunk Search

How to output from lookup table if a field value is included anywhere within table field

epw0rrell
Path Finder

I know how to use eval and if statements to pull fields that contain a %.value.% but how can I use this when running a search | lookup and output fields that contain a value of a field within the search?  Let me know if you need an example search or more context.  Thanks to anyone that can help me with this.

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

An example and more context would be helpful

0 Karma

epw0rrell
Path Finder

I have one index of alerts containing a field named "alertDomain" with values like "domain.com."

I have a lookup table with urls sent within emails with values like http://www.domain.com/otherplaces 

I would like to run a search like this:

index=alerts | lookup emailURLs.csv emailURL as alertDomain OUTPUT emailURL as phishingURL | table phishingURL

but I know this won't work because the fields will not match.  I need to OUTPUT the emailURL if it simply contains the value within alertDomain.

Is this a bit better?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you add another column to the emailURLs.csv file with the domain part of the URL so that you can get a match?

0 Karma

epw0rrell
Path Finder

Unfortunately there is only a URL field within the logs.  Unless I can use a clever field extraction on the URL, I would need to go about it from this direction.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...