I have a quick question about comparison fields from a lookup table. Just imagine that I have a query like this.
index=linux [|inputlookup suspicious_commands.csv where command | fields command ] Basically I have a lookup table that includes some Linux commands and I want to compare it with command fields from the origin log source.
Question is that I want to run the "contains" function on the original command fields from lookup.
Let say lookup has a command like: "rm -rf" but the log itself is "/usr/bin/rm -rf." in the command field Can I do this search based on contains instead of the exact match?
so you should look into lookup definitions. You can try adding a "WILDCARD(FieldA)" in order to query off of likeliness. So you're lookup file would contain '*rm -rf*', and this would match your criteria.