Splunk Search

How to output from lookup table if a field value is included anywhere within table field

epw0rrell
Path Finder

I know how to use eval and if statements to pull fields that contain a %.value.% but how can I use this when running a search | lookup and output fields that contain a value of a field within the search?  Let me know if you need an example search or more context.  Thanks to anyone that can help me with this.

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

An example and more context would be helpful

0 Karma

epw0rrell
Path Finder

I have one index of alerts containing a field named "alertDomain" with values like "domain.com."

I have a lookup table with urls sent within emails with values like http://www.domain.com/otherplaces 

I would like to run a search like this:

index=alerts | lookup emailURLs.csv emailURL as alertDomain OUTPUT emailURL as phishingURL | table phishingURL

but I know this won't work because the fields will not match.  I need to OUTPUT the emailURL if it simply contains the value within alertDomain.

Is this a bit better?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you add another column to the emailURLs.csv file with the domain part of the URL so that you can get a match?

0 Karma

epw0rrell
Path Finder

Unfortunately there is only a URL field within the logs.  Unless I can use a clever field extraction on the URL, I would need to go about it from this direction.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...