Splunk Enterprise

data model and lookup table

AbubakarShahid
New Member

How do I run my list of IOC from my lookup table against a web datamodel by using tstats.
I can do the regular IOC lookup table against the indexes and it work perfectly fine, however, it just take a lot of memory.
It would be help if some one knows how to run csv or kv to compare it with datamodel.

Tags (1)
0 Karma

HiroshiSatoh
Champion

Try this!

|tstats count from datamodel=Web where [| inputlookup http_intel.csv | fields url | rename url as Web.url]  by Web.url
0 Karma

xpac
SplunkTrust
SplunkTrust

Could you give an example what you're already doing, your data, your lookup, your expected output, etc?

0 Karma

AbubakarShahid
New Member

for example here is a very basic search i am running
|tstats count from datamodel=Web by Web.url
| search
[| inputlookup http_intel
| fields url
| rename url as Web.url]

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...