Splunk Search

Lookup Tabel with UrLs

tmwhitm
New Member

Looking for assistance in creating a lookup table with UrLs, my syntax below does not work. Any ideas on how to use a lookup table with UrLs?

index="p*" [ | inputlookup UrL-Input | stats values(UrL) as url | format ] | stats count by src_ip,url,action
| sort action

The lookup table UrL-Input contains two columns, URL & Description.

Any assistance is appreciated.

Tom

Tags (2)
0 Karma

tmwhitm
New Member

Yes, my data had www.example.com so I added that verbatim to the lookup table but the data was not found until I added www.example.com to the lookup table.

0 Karma

tmwhitm
New Member

Jkat54,

Thank you. Before your post I was playing with the lookup table and found that when I added a wildcard at the beginning and end of the url, the SQL I have worked. Still trying to wrap my mind around why for even when I tested www.example.com and it existed in the data, it was not found until I added the wildcard.

0 Karma

jkat54
SplunkTrust
SplunkTrust

That sounds odd. Are you saying this “unpacked” search works?

(( url=value1))

But this doesn’t:

((url=value1))

Even though you have a field called url with “value1” in it...

0 Karma

jkat54
SplunkTrust
SplunkTrust

Use this as your subsearch instead:

| inputlookup UrL-Input | rename UrL as url | format

Which will unpack to

... ( ( url=value1 ) OR( url=value2) OR ... )

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...