Splunk Search

Splunk lookup table info and search

Splunk_rocks
Path Finder

Hello Splunkers,

Can you help me below case to build splunk search.

I have firewall data coming to index=firewall so i need to filter based on results from my external lookups fields IP as well matching domain name from the indexed data.

index=firewall | lookup url.csv | fields url | lookup domain.csv | fields domain | .. etc
any of the matching fields from indexed data.

0 Karma

dindu
Contributor

|Hi,

I assume you have common fields in url lookup and domain look up.
Please try out the below and let us know

 index=firewall 
| lookup url.csv  url  OUTPUT url,domain_index
| lookup domain.csv  domain as domain_index OUTPUT domain
 |table url,domain
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...