I have a CSV file that contains several different IOCs, such as domains, hashes, ip addresses, and email addresses. I would like to perform a search and return all matches with a count.
column field :ioc
Example of CSV file:
I am able to get the search to work and return the events with the following query:
index=* sourcetype=* [|inputlookup ioc.csv |rename ioc as query|fields query]
The problem I am having is returning a count for the matches, since some matches fall under different fields. For example, if the search listed above returns a total of 3 events, 2 domain matches, and 1 hash match if did the following:
index=* sourcetype=* [|inputlookup ioc.csv |rename ioc as query|fields query]|stats count by domain
The domain matches will return with the count, but not the hash results. How would go about performing a count on all matches that are returned?
Thanks in Advance!
That will only read the csv file into Splunk and provide the count. I want to search my indexed data for any maches on the csv file and return the ioc and count.
What does ioc map to in your indexed data? Is it query? What's domain? Have you tried
index=* sourcetype=* [|inputlookup ioc.csv |rename ioc as query|fields query]|stats count by query
Can you provide details on your indexed data you want to include in your search?