Values from inputlookup file not captured in syslog

[Maverick904]

Hello All,

I wrote below query to get the URLs from inputlookup file that is not captured in syslog.But didnt give me any results.Can someone please help me to find out the issue with below query.

1. |inputlookup URLs.csv | fields Domains| rename Domains as domain | join domain[search index=* sourcetype=syslog eventtype=DNS host="device1" OR host="device2" | where domain=""] | table domain

[micahkemp]

I suggest you move your search strings around such that your inputlookup is the one inside your join search:

index=* sourcetype=syslog eventtype=DNS host="device1" OR host="device2" 
| where domain="" 
| join domain 
    [| inputlookup URLs.csv 
    | fields Domains 
    | rename Domains as domain 
    ] 
| table domain

In your example (and in mine as I tried to keep it the same as yours), you are searching for an empty domain field, but are also joining on the same domain field. This seems like it would cause an issue with your join.

[Maverick904]

@micahkemp

Thank you so much for your input.I ran the query u have provided.But no results found.
please Correct me if i am wrong.the query you have given,will take each domain from lookupfile and search it in syslog. And if the URL not found in syslog,then it will list in table?

[micahkemp]

I'm not sure that the search I pasted actually accomplishes anything of value, because I don't really understand your use case. Can you explain more about what it is you are looking for in terms of searching and how the CSV could be used?

What I have above looks like it would end up performing basic lookup capabilities, which would be better accomplished by using the lookup command with the csv in question.

[Maverick904]

Actually i have few URLs in inputlookup file.i want each URL from lookup file to be searched in syslog.And whichever URLs are not found in syslog,should be showed in a table..