Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to search for values in a lookup table with wildcard

$
0
0
My lookup table is a simple list of malicious domains. How can I do a search such that I can search for the `malicious domain*` instead of just an exact match for the `malicious domain` in my firewall logs? **Lookup table** badsite.com malware.com **I want it to match against** theother.badsite.com/ microsoft.malware.com/download.exe **Current Query** index=web [|inputlookup badboylist.csv | fields uri] | stats count by uri

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>