how to use lookups to compare a csv against indexed DNS data

[vitalechris15]

I am ingesting DNS records into my splunk system. I want to compare these events again a list of Dynamic DNS domains. I've been able to incorporate the CSV of dynamics DNS into Splunk, but when I search I am only finding values that equal the domain, not values that "contain" the domain.

example events: (dns field is called "domain" in my splunk instance)
3322.org
test.3322.org

CSV file format: (called "dynamic_dns")
domain,dyns_dns_servcice (csv header)
3322.org, true (values)

Here's the Splunk query I used:
sourcetype="dns" | lookup dynamic_dns domain | search dyn_dns_service=true

This splunk query returns results for "3322.org", but not the other domain "test.3322.org".

What would be a query to run that would capture both domains? I can't figure out the correct search syntax.

Any help is greatly appreciated. Thank you

[the_wolverine]

You can configure match_type=WILDCARD(domain) in transforms.conf for your lookup file.

http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Addfieldsfromexternaldatasources#Optiona...

Note that your lookup file would need to have a wildcard, so your file would look like:

domain,dyns_dns_servcice (csv header)
*3322.org, true (values)