topic How to import Multiple CSVs as exclude and include lists? in Getting Data In

How to import Multiple CSVs as exclude and include lists?

karatyman — Tue, 29 Sep 2020 10:31:16 GMT

Hello,

I'm trying to do a search for requests made to a list of malicious domains defined in a csv file, but excluding a list of source IPS. So far this is what I have, but I get no results:

sourcetype=bro OR sourcetype=Proxy [inputlookup Malware_Domains.csv| fields Malware_Domains] NOT [inputlookup Exclude_IP.csv| fields Exclude_IP]

My desired results will be all the IPs not in the exclude list, that are going to domains in the malware domains list, however currently I get 0/0 where as if I do my search with a Malwaredomain1 OR malware domain2 src_ip=!x.x.x.x AND src_ip=!x.x.x.x.... I get multiple results. I'm simply just trying to clean up this search and learn how to import CSVs

Re: How to import Multiple CSVs as exclude and include lists?

jpolcari — Tue, 29 Sep 2020 10:37:48 GMT

Where are the lookup files located? Are they in: Splunk\etc\system\lookups?

What is also important are the field names in the csv files. I see that you are calling the fields: Malware_Domains and Exclude_IP. With your current search you would have to have fields that match that name in the proxy and bro sourcetypes. You could add before | fields:

| rename Exclude_IP AS dest_ip

dest_ip would be whatever the IP field in your logs is. Hope this helps.

Re: How to import Multiple CSVs as exclude and include lists?

sundareshr — Fri, 12 Aug 2016 22:08:53 GMT

@karatyman Try this

sourcetype=bro OR sourcetype=Proxy [inputlookup Malware_Domains.csv| eval search="*".Malware_Domains."*" | fields search ] NOT [inputlookup Exclude_IP.csv| rename Exclude_IP as src_ip | fields src_ip]