Using multiple lookup tables in a query

[MM0071]

index=netlogs [| inputlookup baddomains.csv | eval url = "*.domain."*" | fields url] NOT [| inputlookup good_domains.csv | fields domain]

I don't think my search is doing what I want it to do. I would like to take the bad domains from the first lookup table and search the netlogs index to see if there are any hits. however, i would like to remove the good domains from the second lookup table from the search. Anyone know if there is a better way to do this?

[gcusello]

Hi @MM0071 ,

let me understand, you want to filter the results of the main search using the first lookup, already filtered suing the second one, is it correct?

If this is your requirement, my first hint is to run a search the filters the raws of the first lookup using the second on so you have to use only one lookup.

Anyway, if you want to use both the lookups in the same search, you can use your search and it should work fine

or use the second lookup in the first lookup subsearch:

index=netlogs [| inputlookup baddomains.csv | search NOT [| inputlookup good_domains.csv | fields domain] | eval url = "*.domain."*" | fields url] 

or something similar.

Ciao.

Giuseppe

[richgalloway]

That can be accomplished with a single list by good list management.  Anything on the baddomains list should not be in the gooddomains list and vice versa.

That said, what you have should work, but not as efficiently as a single list.  A domain on both lists will not appear in the results, which is the intent.

For debugging purposes, run each subsearch on its own with | format appended to verify it returns the expected results.  You may need to leave the format command in the final query, combined.