Hello all,
I have indexed data that contains an extracted field (domain) and a CSV (https.csv) file with the following headers URL,IP,Location_Code,Location_Name. I'd like to return ONLY events that concern the domains in the CSV files.
| lookup https URL as domain OUTPUT IP, Location_Code, Location_Name
Would the above return only the events where the domain fields values match the values under the URL header in my CSV file?
Thank you!
Hi adabud6267,
try something like this:
index=domain [ | inputlookup https | rename URL as domain | fields domain ]
| ...
beware that the field name (domain) must be the same in main search and subsearch.
If you want to run the search with a substring of URL field, you have to extract it using substr function or a regex.
Bye.
Giuseppe
Hi adabud6267,
try something like this:
index=domain [ | inputlookup https | rename URL as domain | fields domain ]
| ...
beware that the field name (domain) must be the same in main search and subsearch.
If you want to run the search with a substring of URL field, you have to extract it using substr function or a regex.
Bye.
Giuseppe
Hello @cusello
Thank you for your answer! It works. Please tell me on thing.
will www.domain-foo.com match domain-foo.com ?
Also it appears, that I cannot use the fields from the csv file as I would do it with the lookup command. I'd like to add a column containing the city code from the CSV file if a domain match is found.
Thank you and I appreciate your help !
To match a substring, you can use "*" at the beginning and the end of the string in you search.
Otherwise, in you search you can use
index=domain [ | inputlookup https | rename URL as query | fields query ]
| ...
Bye.
Giuseppe
@adabud6267 If your problem is resolved, please accept the answer to help future readers.