How to search with the value of field as a variable pattern to match other fields?

[Log_wrangler]

Hi
Here is an example of what I am after.

I am trying to search URL strings that contain a specific domain.tld as a matching pattern variable.

For example, I have a lookup with bad domains. One such domain is "malicious.com"

I want to find and match "malicious.com" if the string contains "cdn.malicious.com" OR if it contains san.cdn.malicious.com.edgekey.net" etc...

I am not sure what the best way to do this is. Tried Regex but did not figure out how to use the interesting domain.tld as a variable.

I hope that makes sense.

Thank you

[somesoni2 · Accepted solution]

Give this a try

your base search i.e. index=foo sourcetype=bar  [| inputlookup baddomainlookup.csv | table domain | eval search="*".domain."*" | table search]

[adamcoquim]

What if you would like to use the subsearch results to search against a specfic field in the base search?

Example: your base search i.e. index=foo sourcetype=bar URL=$search [| inputlookup baddomainlookup.csv | table domain | eval search="".domain."" | table search]

Would something like that work to reference the subsearch results?

[somesoni2]

The subsearch shown below will return values of field domain as quoted string and add to base search as filter. This is because we're renaming it to special field name "search".

[| inputlookup baddomainlookup.csv | table domain | eval search="".domain."" | table search]

Resulting query

index=foo sourcetype=bar "Domain1" OR "Domain2" OR "Domain3"...

If you want to compare it with specific field name, then rename the field domain to that field name, instead of search, e.g.

 index=foo sourcetype=bar  [| inputlookup baddomainlookup.csv | table domain | rename domain as URL]