Splunk Search

Using multiple lookup tables in a query

MM0071
Path Finder

index=netlogs [| inputlookup baddomains.csv | eval url = "*.domain."*" | fields url] NOT [| inputlookup good_domains.csv | fields domain]

I don't think my search is doing what I want it to do. I would like to take the bad domains from the first lookup table and search the netlogs index to see if there are any hits. however, i would like to remove the good domains from the second lookup table from the search. Anyone know if there is a better way to do this?

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @MM0071 ,

let me understand, you want to filter the results of the main search using the first lookup, already filtered suing the second one, is it correct?

If this is your requirement, my first hint is to run a search the filters the raws of the first lookup using the second on so you have to use only one lookup.

Anyway, if you want to use both the lookups in the same search, you can use your search and it should work fine

or use the second lookup in the first lookup subsearch:

index=netlogs [| inputlookup baddomains.csv | search NOT [| inputlookup good_domains.csv | fields domain] | eval url = "*.domain."*" | fields url] 

or something similar.

Ciao.

Giuseppe

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That can be accomplished with a single list by good list management.  Anything on the baddomains list should not be in the gooddomains list and vice versa.

That said, what you have should work, but not as efficiently as a single list.  A domain on both lists will not appear in the results, which is the intent.

For debugging purposes, run each subsearch on its own with | format appended to verify it returns the expected results.  You may need to leave the format command in the final query, combined.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...