I am ingesting DNS records into my splunk system. I want to compare these events again a list of Dynamic DNS domains. I've been able to incorporate the CSV of dynamics DNS into Splunk, but when I search I am only finding values that equal the domain, not values that "contain" the domain.
example events: (dns field is called "domain" in my splunk instance)
3322.org
test.3322.org
CSV file format: (called "dynamic_dns")
domain,dyns_dns_servcice (csv header)
3322.org, true (values)
Here's the Splunk query I used:
sourcetype="dns" | lookup dynamic_dns domain | search dyn_dns_service=true
This splunk query returns results for "3322.org", but not the other domain "test.3322.org".
What would be a query to run that would capture both domains? I can't figure out the correct search syntax.
Any help is greatly appreciated. Thank you
You can configure match_type=WILDCARD(domain) in transforms.conf for your lookup file.
Note that your lookup file would need to have a wildcard, so your file would look like:
domain,dyns_dns_servcice (csv header)
*3322.org, true (values)