Splunk Search

Splunk lookup table info and search

Splunk_rocks
Path Finder

Hello Splunkers,

Can you help me below case to build splunk search.

I have firewall data coming to index=firewall so i need to filter based on results from my external lookups fields IP as well matching domain name from the indexed data.

index=firewall | lookup url.csv | fields url | lookup domain.csv | fields domain | .. etc
any of the matching fields from indexed data.

0 Karma

dindu
Contributor

|Hi,

I assume you have common fields in url lookup and domain look up.
Please try out the below and let us know

 index=firewall 
| lookup url.csv  url  OUTPUT url,domain_index
| lookup domain.csv  domain as domain_index OUTPUT domain
 |table url,domain
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...