topic Re: filter out events from lookuptable in Splunk Dev

filter out events from lookuptable

benmon — Tue, 29 Sep 2020 09:09:05 GMT

Hi,

I have the correlation rule-Substantial Increase In Events enabled but I just want to fine tune this rule based on our environment.

I dont want this rule to fire when there is a match in the signature that is defined in the lookuptable "substantialincreasesignature.csv".

But as soon as I run this it is throwing an error,can you check out this for me.

| tstats allow_old_summaries=true count,values(IDS_Attacks.tag) as orig_tag from datamodel=Intrusion_Detection by IDS_Attacks.signature| search IDS_Attacks.signature!=* [inputlookup substantialincreasesignature.csv]

| tstats allow_old_summaries=true count,values(IDS_Attacks.tag) as orig_tag from datamodel=Intrusion_Detection by IDS_Attacks.signature as signatures AND NOT[|inputlookup substantialincreasesignature|fields signature]

Both search I tried but no results:(

Regards,

Re: filter out events from lookuptable

martin_mueller — Mon, 21 Mar 2016 17:59:27 GMT

You say it's throwing an error - what error?

Re: filter out events from lookuptable

somesoni2 — Mon, 21 Mar 2016 18:28:55 GMT

Give this a try

| tstats allow_old_summaries=true count,values(IDS_Attacks.tag) as orig_tag from datamodel=Intrusion_Detection by IDS_Attacks.signature
| search NOT [|inputlookup substantialincreasesignature|fields signature]

Update
It could be the field names returned by the data model doesn't match the field name in lookup. Replace the inputlookup query with this in above

| inputlookup substantialincreasesignature | table signature | rename signature with ExactFieldNameFromDataModelResult]

To get the ExactFieldNameFromDataModelResult, run your base search and check the name of signature field.

 | tstats allow_old_summaries=true count,values(IDS_Attacks.tag) as orig_tag from datamodel=Intrusion_Detection by IDS_Attacks.signature

Re: filter out events from lookuptable

benmon — Tue, 29 Sep 2020 09:09:58 GMT

somesoni2,

your query is working fine,but it is showing data that is present in the lookuptable 'substantialincreasesignature'.I dont want to see the data that I have specified in the lookup table.

| tstats allow_old_summaries=true count,values(IDS_Attacks.tag) as orig_tag from datamodel=Intrusion_Detection by IDS_Attacks.signature
| search NOT [|inputlookup substantialincreasesignature|fields signature]

Re: filter out events from lookuptable

benmon — Tue, 29 Sep 2020 09:11:38 GMT

is showing results that is in lookuptable.

How to get the events that is not in the lookuptable?

Re: filter out events from lookuptable

somesoni2 — Wed, 23 Mar 2016 14:20:03 GMT

See the updated section of the answer