Hello @gcusello  This searches the whole raw event. What if I wanted to search only the value of particular field in _raw ? ... View more

Thanks @gcusello . That works. ... View more

Hello @gcusello  Thanks for your reply. I wanted to find the matching values. But in this case, My tc lookup will be having indicator="Michael" whereas my  firewall would have name= "Michael Jonas" So I wanted to append wild card to my indicator field in lookup field and search as indicator=*Michael*. But since it is wildcard appended I was not able to do matching using join or union. Hence tried using text search method. ... View more

Hi @ITWhisperer  Tried using format now. But this as well is not returning any results although our inner sub search is returning results. ... View more

HI @gcusello  Finally they have renamed the field in config files also and now it is working. Thanks. ... View more

Hi @manjunathmeti  My case is same as described in post suggested by you,  https://community.splunk.com/t5/All-Apps-and-Add-ons/Lookup-command-doesn-t-support-dot-notation-in-... The field itself is mentioned only "tag" in definition. PFB the image,   But when I run |inputlookup tci|search indicator="*" the results are like below with tag.name field, Also I tried, sourcetype="email*"|lookup tci indicator output type,rating,tag as tag.name|where isnotnull(type)|dedup indicator|table indicator  tag.name Still getting empty field. Is there any other way where I can rename my field manually except getting into lookup definitions. ... View more

Hi @gcusello  The field itself is mentioned only "tag" in definition. PFB the image, But when I run |inputlookup tci|search indicator="*" the results are like below with tag.name field, My cases is same as described in post,  https://community.splunk.com/t5/All-Apps-and-Add-ons/Lookup-command-doesn-t-support-dot-notation-in-field-name/m-p/500643 Also I tried, sourcetype="ms:o365*" | rename SenderAddress as indicator |lookup tci indicator output type,rating,tag as tag.name|where isnotnull(type)|dedup indicator|table indicator  tag.name Still getting empty field. Is there any other way where I can rename my field manually except getting into lookup definitions. ... View more

Hi @manjunathmeti  If I give subsearch I am getting truncated results since my lookup and sourcetype have heavy results. Thats the reason I decided to move to lookup command, Also I looked into definition of tci lookup where I could see in supported field column it is, "tag". So I ran the query as below, sourcetype="ms:o365*" | rename SenderAddress as indicator |lookup tci indicator output type,rating,tag|where isnotnull(type)|dedup indicator|table indicator tag Now I am not getting any error, but my tag column is empty. Then I tried running the below query without renaming tag.name field since tag field was supported in earlier query, |inputlookup tci|search indicator="*"|table indicator tag Here it says, No matching fields exist. ... View more

Hi @gcusello  Sorry for my previous post. It had repetitions, I can rename my field like below, |inputlookup tci|search indicator="*"|rename tag.name as tag|table indicator tag Also I looked into definition of tci lookup where I could see in supported field column it is, "tag". So I ran the query as below, sourcetype="ms:o365*" | rename SenderAddress as indicator |lookup tci indicator output type,rating,tag|where isnotnull(type)|dedup indicator|table indicator tag Now I am not getting any error, but my tag column is empty. Then I tried running the below query without renaming tag.name field since tag field was supported in earlier query, |inputlookup tci|search indicator="*"|table indicator tag Here it says, No matching fields exist. ... View more

Hi @gcusello  I can rename my field like below, |inputlookup tci|search indicator="*"|rename tag.name as tag|table indicator tag Also I looked into definition of tci lookup where I could see in supported field column it is, "tag". So I ran the query as below, sourcetype="ms:o365*" | rename SenderAddress as indicator |lookup tci indicator output type,rating,tag|where isnotnull(type)|dedup indicator|table indicator  tag Now I am not getting any error, but my tag column is empty. Then I tried running the below query without renaming tag.name field since tag field was supported in earlier query, |inputlookup tci|search indicator="*"|table indicator tag Here it says, I can rename my field like below, |inputlookup tci|search indicator="*"|rename tag.name as tag|table indicator tag Also I looked into definition of tci lookup where I could see in supported field column it is, "tag". So I ran the query as below, sourcetype="ms:o365*" | rename SenderAddress as indicator |lookup tci indicator output type,rating,tag|where isnotnull(type)|dedup indicator|table indicator  tag Now I am not getting any error, but my tag column is empty. Then I tried running the below query without renaming tag.name field sice tag field was supported in earlier query, |inputlookup tci|search indicator="*"|table indicator tag Here it says, No field match the criteria.I can rename my field like below, |inputlookup tci|search indicator="*"|rename tag.name as tag|table indicator tag Also I looked into definition of tci lookup where I could see in supported field column it is, "tag". So I ran the query as below, sourcetype="ms:o365*" | rename SenderAddress as indicator |lookup tci indicator output type,rating,tag|where isnotnull(type)|dedup indicator|table indicator  tag Now I am not getting any error, but my tag column is empty. Then I tried running the below query without renaming tag.name field sice tag field was supported in earlier query, |inputlookup tci|search indicator="*"|table indicator tag Here it says, No matching fields exist. ... View more

Hi @manjunathmeti  The lookup tci is of type KV store and not file type. ... View more

Hi @manjunathmeti  I tried like below, sourcetype="email*" | rename SenderAddress as indicator |lookup tci indicator output type,"tag.name" as tag|where isnotnull(type)|dedup indicator|table indicator tag Even this is returning the error, Error in 'lookup' command: Could not find all of the specified destination fields in the lookup table. ... View more

Hi @gcusello , I dont know what is the error there I cant even mention the name tag.name in output field. It is returning error, Query: sourcetype="email*" | rename SenderAddress as indicator |lookup tci indicator output type,"tag.name" as tag|where isnotnull(type)|dedup indicator|table indicator tag Error: Error in 'lookup' command: Could not find all of the specified destination fields in the lookup table. But I am able to filter tag.name field in tci lookup as below, |inputlookup tci|search tag.name="*sample" ... View more

Hi @gcusello  I tried the below queries, Query 1: sourcetype = "email" [ | inputlookup tci WHERE type=emailaddress | rename indicator AS SenderAddress | dedup SenderAddress | fields SenderAddress ] | stats count by SenderAddress For which I am getting the job status as,  [subsearch]: Subsearch produced 4815473 results, truncating to maxout 10000. I hope so because of having subsearch and hence tried, Query 2: sourcetype="email" | rename SenderAddress as indicator |lookup tci indicator output type|where isnotnull(type)|dedup indicator|table indicator FromIP dest action RecipientAddress Subject Received I am getting the desired result for the second query. But the only thing is I am not able to filter tci lookup. For example If I want to lookup tci which has tag!="sample",  I tried something like below but is not working, sourcetype="email" | rename SenderAddress as indicator |lookup tci indicator output type|where isnotnull(type)|where tag!="sample"|dedup indicator|table indicator FromIP dest action RecipientAddress Subject Received ... View more

Hello @gcusello  I am getting timeout error If I filter with Address like below, [subsearch]: Subsearch produced 1924551 results, truncating to maxout 10000. It is still huge. ... View more

Hi @ITWhisperer , Not working in the sense I am not getting the desired result. My intention is to do inner join and get the common indicator set between sourcetype=email and inputlookup=tc.  But If I am using sub search in my query it is either truncating the result or getting timed out. I just tested with dedup and without dedup to setup any logic. ... View more

Hi @gcusello  I am getting the below issue when I am querying like that, [subsearch]: Subsearch produced 4815473 results, truncating to maxout 10000. Hence I tried to use lookup. Is there any other way to overcome this. ... View more

Thanks @richgalloway  That will help. But is there any way I can identify any modifications in the list, like Indicator[a.b] changed to Indicator[c,d]. ... View more