How to table results only if field value within indexA is contained within field of indexB

[epw0rrell]

I have email logs within index=Email and suspicious domain connections within index=Security.

The field name within Security = domain (values look like "website.com")

The field of interest in Email = URL (values look like https://www.corp.website.com/page1/page2/etc:443)

I need to search index=Email and do a sub-search within index=Security and only return results if domain is contained within URL.

I tried things like:

index=Email [search index=Security | where like(URL, "%"."domain"."%")]

Anyone that can help me you will make my week!  Thanks for your time.

[epw0rrell]

Thanks that worked great.  If I could ask a follow on to this, would there be a way to include the query string that hit on the sessions displayed?  I output the results to a lookup file thinking I could append the "query" column to the results (query shown below) but that just added all the domains used in the query to the lookup file.

| inputlookup emailHITS.csv | appendcols [search index=security | fields domain | rename domain as query] | table _time query subject url fromEmail fromIP fromMX

[to4kawa · Accepted solution]

index=Email [search index=Security |fields domain|rename domain as search]