Splunk Search

Splunk lookup table info and search

Path Finder

Hello Splunkers,

Can you help me below case to build splunk search.

I have firewall data coming to index=firewall so i need to filter based on results from my external lookups fields IP as well matching domain name from the indexed data.

index=firewall | lookup url.csv | fields url | lookup domain.csv | fields domain | .. etc
any of the matching fields from indexed data.

0 Karma



I assume you have common fields in url lookup and domain look up.
Please try out the below and let us know

| lookup url.csv  url  OUTPUT url,domain_index
| lookup domain.csv  domain as domain_index OUTPUT domain
 |table url,domain
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...