Getting Data In

CSV Searches

rlamezquita
New Member

Hello everyone. I've been reading and reading and I can not get consistent results from anything I have tried. So hopefully someone can help me get this straight. I have a csv as follows:

Indicator Type, Indicator, Description
domain, google.com, stuff
hash, asdfasdfdf4a6sd54fa6sd4fa6sd4f6sd, stuff
file, test.exe, stuff

I am trying to conduct a search that uses the Indicator column to search for ANY instances of the indicator. For example, it should return not just google.com, but also mail.google.com, or google.com.net. Additionally, I want to search the entire log, not just a specific field for that value. Here is what kinda works:

index=myindex | lookup NamedDefinition Indicator as logField OUTPUT Indicator as IOC | search IOC=* | stats count by IOC

That last part doesn't really matter, so it can be fields or whatever. This command works SOMETIMES. Sometimes I get errors that the lookup doesn't exist.

However, when it does work, this only searches one field in a log for something that matches in the csv EXACTLY. I tried putting a wildcard in the value (i.e. *google.com) but did not work. I also do not have access to modify any configuration files. I have also seen this command:

index=myindex [|inputlookup NamedDefinition.csv | fields Indicator]

but that has never returned any results. I know there are results (I use google.com as a control domain as well). Any help would be extremely appreciated.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Try this ...

index=myindex 
[| inputlookup NamedDefinition.csv  | table Indicator  | format "(" "" "" "" "OR" ")"  | rex mode=sed field=search "s/Indicator=//g"]

To see what is coming out of the subsearch, and adjust it, run this...

| inputlookup NamedDefinition.csv  
| table Indicator  
| format "(" "" "" "" "OR" ")"  
| rex mode=sed field=search "s/Indicator=//g"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...