This SPL didn't give me any error but somehow giving me all events matched but not displaying any results on the Statistics. Below is the status from Splunk search : 1,550,000 of 1,550,000 events matched but - Statistics (0) ... View more

I have tried it with three backslashes as well. No luck! Here is my scenario, I have had a list of IOCs that I would like to search with our datasets (indexes) to find if any Users tried to reach to those IOCs. as the list of IOCs kept increasing we have created a lookup table with a list of '80+ urls' (without using 'http://') example: fourtion.com/qyBf2DfGd As I have created the lookup table, now would like to see if any user has accessed these IOCs listed in inputlookup table in Enterprise Security using SLP. let me know if you more information. ... View more

here is the sample data from the table IOCs-URLs.csv - - 'I would suggest not to go to the click or go to this IOC'. fourtion.com/qyBf2DfGd ... View more

didn't work, still same error - Error in 'rex' command: Invalid argument: 'NOT' here is my current SPL index=xxxx* | rex field=url "(?<domain>\w+\.\w+)\\/" [| inputlookup IOCs-URLs.csv | stats values(UrL) as url | format] | stats count as NumOTimes by src_ip,url ... View more