I've confirmed that the following search works:
index=* sourcetype=proxy | eval domain="google" | where match(_raw,domain) | table _raw
but instead of defining domain on the command line, I'd like to pull values from a column called domain in the file ioc.csv that I uploaded.
Any ideas?
Try this
index=* sourcetype=proxy [ inputlookup mydomains | table domain | eval domain="*".domain."*" | rename domain AS search | format]
You can do this with a subsearch:
index=* sourcetype=proxy [ inputlookup mydomains | table domain | rename domain AS search | format]
If you specifically wanted to check the domain
field for a match, you could use the following:
index=* sourcetype=proxy [ inputlookup mydomains | fields domain]
As long as the field name in the input matches the field name in the data (for example if you have a field in the lookup named "domain" and then the field in your proxy data is "domain" as well). If the field names do not match, you can use a rename command in the subsearch:
index=* sourcetype=proxy [ inputlookup mydomains | fields badguy | rename badguy AS domain]
Great stuff, thanks guys.