How to search using a list as input?

[four]

I have a list of domain names in an input file. I have a log source with a bunch of dns logs. I want to return any logs tha have even a partial match of the dns names.

So dns.txt has:

blah.com
lol.com
...

And my log source has a field called "hostname" that might be like "toad.blah.com". If blah.com from dns.txt matches as a substring in the hostname field, then I want to see that log in my result set.

Thanks!

[sdaniels · Accepted solution]

I think this is similar to what you are trying to do and should help get you there. Your file would look like this with dns_name or whatever you call it as the header.

dns_name
blah.com
lol.com

http://splunk-base.splunk.com/answers/2457/inputlookup-against-a-list-of-bad-domains

[rgonzale6]

You'd do something like this...

index=*whatever* [inputlookup dns.txt.csv | fields hostname | rename hostname as search]

Your .csv file has to be in a 'lookups' directory in either the parent or a child local directory - like /opt/splunk/etc/apps/search/lookups. (I've only used .csv files - not sure .txt would work)

In this case, dns.txt.csv is a single-column csv with hostname (being the column name, etc) as the first value and the domains to be searched as the subsequent lines. The 'rename fields as search' means it'll return more than just 1:1 value matches - ex: blah.com will match when hostname=toad.blah.com and when hostname=blah.com instead of just the latter.