Lookup Tabel with UrLs

[tmwhitm]

Looking for assistance in creating a lookup table with UrLs, my syntax below does not work. Any ideas on how to use a lookup table with UrLs?

index="p*" [ | inputlookup UrL-Input | stats values(UrL) as url | format ] | stats count by src_ip,url,action
| sort action

The lookup table UrL-Input contains two columns, URL & Description.

Any assistance is appreciated.

Tom

[tmwhitm]

Yes, my data had www.example.com so I added that verbatim to the lookup table but the data was not found until I added www.example.com to the lookup table.

[tmwhitm]

Jkat54,

Thank you. Before your post I was playing with the lookup table and found that when I added a wildcard at the beginning and end of the url, the SQL I have worked. Still trying to wrap my mind around why for even when I tested www.example.com and it existed in the data, it was not found until I added the wildcard.

[jkat54]

That sounds odd. Are you saying this “unpacked” search works?

(( url=value1))

But this doesn’t:

((url=value1))

Even though you have a field called url with “value1” in it...

[jkat54]

Use this as your subsearch instead:

| inputlookup UrL-Input | rename UrL as url | format

Which will unpack to

... ( ( url=value1 ) OR( url=value2) OR ... )