Splunk Search

Lookup Tabel with UrLs

New Member

Looking for assistance in creating a lookup table with UrLs, my syntax below does not work. Any ideas on how to use a lookup table with UrLs?

index="p*" [ | inputlookup UrL-Input | stats values(UrL) as url | format ] | stats count by src_ip,url,action
| sort action

The lookup table UrL-Input contains two columns, URL & Description.

Any assistance is appreciated.

Tom

Tags (2)
0 Karma

New Member

Yes, my data had www.example.com so I added that verbatim to the lookup table but the data was not found until I added www.example.com to the lookup table.

0 Karma

New Member

Jkat54,

Thank you. Before your post I was playing with the lookup table and found that when I added a wildcard at the beginning and end of the url, the SQL I have worked. Still trying to wrap my mind around why for even when I tested www.example.com and it existed in the data, it was not found until I added the wildcard.

0 Karma

SplunkTrust
SplunkTrust

That sounds odd. Are you saying this “unpacked” search works?

(( url=value1))

But this doesn’t:

((url=value1))

Even though you have a field called url with “value1” in it...

0 Karma

SplunkTrust
SplunkTrust

Use this as your subsearch instead:

| inputlookup UrL-Input | rename UrL as url | format

Which will unpack to

... ( ( url=value1 ) OR( url=value2) OR ... )

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!