I have a list of malicious URL's that I have inputted into a lookup table called badurls.csv. I created a field in the table called domains. I want to compare that lookup table against an Index and specifically against a field called Domain to see if we have any traffic going to this list of malicious URL's. My .csv file has over 3 million entries. I tried the search below but its not giving me all results and its complaining about a 10,000 line subsearch limit. index="dns" | eval d=substr(Domain, 1, len(Domain)-1) | search * [|inputlookup badurls.csv | rename domains as d | fields + d ] | stats count by d Any ideas on a better way to do this?
... View more