Splunk Search

Using multiple lookup tables in a query

MM0071
Path Finder

index=netlogs [| inputlookup baddomains.csv | eval url = "*.domain."*" | fields url] NOT [| inputlookup good_domains.csv | fields domain]

I don't think my search is doing what I want it to do. I would like to take the bad domains from the first lookup table and search the netlogs index to see if there are any hits. however, i would like to remove the good domains from the second lookup table from the search. Anyone know if there is a better way to do this?

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @MM0071 ,

let me understand, you want to filter the results of the main search using the first lookup, already filtered suing the second one, is it correct?

If this is your requirement, my first hint is to run a search the filters the raws of the first lookup using the second on so you have to use only one lookup.

Anyway, if you want to use both the lookups in the same search, you can use your search and it should work fine

or use the second lookup in the first lookup subsearch:

index=netlogs [| inputlookup baddomains.csv | search NOT [| inputlookup good_domains.csv | fields domain] | eval url = "*.domain."*" | fields url] 

or something similar.

Ciao.

Giuseppe

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That can be accomplished with a single list by good list management.  Anything on the baddomains list should not be in the gooddomains list and vice versa.

That said, what you have should work, but not as efficiently as a single list.  A domain on both lists will not appear in the results, which is the intent.

For debugging purposes, run each subsearch on its own with | format appended to verify it returns the expected results.  You may need to leave the format command in the final query, combined.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...