I have a lookup table named ics_special_domains that contains this:
domain_name,type microsoft.com,microsoft *.microsoft.com,microsoft google.com,google *.google.com,google nwngms.com,ot *.nwngms.com,ot gasco.com,it *.gasco.com,it
I'm trying to use this in a search to filter on specific types, but I'm trying a basic search first. This is the most basic search I'm trying:
index=ics_dns ( query_type="A" OR query_type="AAAA" ) | lookup ics_special_domains domain_name as query{} outputnew type as domain_type | where domain_type="microsoft"
It returns this error:
basic_string::erase: __pos (which is 18446744073709551615) > this->size() (which is 0)
I'd appreciate any help figuring this out.
... View more