topic Re: Issue in excluding some results via Lookup table in Splunk Enterprise

Issue in excluding some results via Lookup table

Erfan110 — Thu, 18 Jan 2024 04:09:08 GMT

Hi everyone
I created a look up table:

Department,Vendor,Type,url_domain,user,src_ip,Whitelisted BigData,Material,Google Remote Desktop,Alpha.com,Alice,172.16.28.12,TRUE

Then I created a look up definition with this match type:

WILDCARD(url_domain), WILDCARD(user), WILDCARD(src_ip)

Then I tested it on following search but it didn't work.

index=fortigate src_ip=172.16.28.12 url_domain=Alpha.com | lookup Whitelist url_domain user src_ip | where isnull(Whitelisted) | table _time, severity, user, url_domain, src_ip, dest_ip, dest_domain, transport, dest_port, vendor_action, app, vendor_eventtype, subtype, devname

and shows all results including traffic from 172.16.28.12 by Alice to the mentioned url
Anyone has any idea what is the issue?

Re: Issue in excluding some results via Lookup table

ITWhisperer — Thu, 18 Jan 2024 10:48:55 GMT

Setting up the lookup the way you described and using makeresults to generate events (rather than an index search) works for me as expected.

So, perhaps your real data or lookup is inconsistent with the description you gave, or you have found a bug. Which version of Splunk are you using?

Re: Issue in excluding some results via Lookup table

PickleRick — Thu, 18 Jan 2024 10:52:44 GMT

Department,Vendor,Type,url_domain,user,src_ip,Whitelisted
BigData,Material,Google Remote Desktop,Alpha.com,Alice,172.16.28.12,TRUE

Are you sure you copy-pasted whole lines?

First line has 8 fields, second one has 7.

Re: Issue in excluding some results via Lookup table

ITWhisperer — Thu, 18 Jan 2024 10:55:45 GMT

@PickleRick Both have 7

Re: Issue in excluding some results via Lookup table

PickleRick — Thu, 18 Jan 2024 10:57:28 GMT

OK. I'm either overworked or blind. I counted them several times and always came up with the same 8/7 numbers.

You're right. They both have 7 fields.

Re: Issue in excluding some results via Lookup table

Erfan110 — Thu, 18 Jan 2024 22:27:45 GMT

Hi
You mean it excluded that traffic? Because I expect it to exclude the traffic from my results.

version 9.0

Re: Issue in excluding some results via Lookup table

ITWhisperer — Fri, 19 Jan 2024 09:29:40 GMT

Yes, it worked

Re: Issue in excluding some results via Lookup table

Erfan110 — Wed, 24 Jan 2024 00:54:07 GMT

Hi
thanks for your response.
I tried same and it is working. but it does not work on my real data.
The problem is IP Address. When I removed src_ip from lookup command it works on real records. But I cannot understand what is the problem!
I checked the name of the field in events and tried srcip and src_ip, both did not work.

Regards