https://community.splunk.com/t5/Getting-Data-In/How-to-compare-IP-blacklists/m-p/450834#M78211 <P>Hi nebblkshts,<BR /> You have to load csv in a lookup (called e.g. ip_blacklist.csv) and then use a search like this:</P> <PRE><CODE>index=my_index [ | inputlookup ip_blacklist.csv | fields source_ip ] | stats count BY source_ip </CODE></PRE> <P>put attention to the fieldname between logs and lookup: they must be the same, if they are different, in the subsearch you have to insert a rename.</P> <P>Bye.<BR /> Giuseppe</P> Thu, 27 Jun 2019 14:54:18 GMT gcusello 2019-06-27T14:54:18Z https://community.splunk.com/t5/Getting-Data-In/How-to-compare-IP-blacklists/m-p/450833#M78210 <P>I want to either compare natdst to a blacklist. <BR /> We do not have a subscription to any service that provides blacklist but I see some free list. <BR /> I am assuming since we do not pay for a service, I have to download a CSV and compare that way. </P> Thu, 27 Jun 2019 13:08:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-compare-IP-blacklists/m-p/450833#M78210 nebblkshts 2019-06-27T13:08:40Z https://community.splunk.com/t5/Getting-Data-In/How-to-compare-IP-blacklists/m-p/450834#M78211 <P>Hi nebblkshts,<BR /> You have to load csv in a lookup (called e.g. ip_blacklist.csv) and then use a search like this:</P> <PRE><CODE>index=my_index [ | inputlookup ip_blacklist.csv | fields source_ip ] | stats count BY source_ip </CODE></PRE> <P>put attention to the fieldname between logs and lookup: they must be the same, if they are different, in the subsearch you have to insert a rename.</P> <P>Bye.<BR /> Giuseppe</P> Thu, 27 Jun 2019 14:54:18 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-compare-IP-blacklists/m-p/450834#M78211 gcusello 2019-06-27T14:54:18Z https://community.splunk.com/t5/Getting-Data-In/How-to-compare-IP-blacklists/m-p/450835#M78212 <P>Thank you, that worked.</P> Thu, 27 Jun 2019 17:38:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-compare-IP-blacklists/m-p/450835#M78212 nebblkshts 2019-06-27T17:38:32Z https://community.splunk.com/t5/Getting-Data-In/How-to-compare-IP-blacklists/m-p/450836#M78213 <P>Hi nebblkshts,<BR /> if you're satisfied by this answer, please accept and/ot upvote it.<BR /> Bye, see at next time.<BR /> Giuseppe</P> Fri, 28 Jun 2019 06:46:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-compare-IP-blacklists/m-p/450836#M78213 gcusello 2019-06-28T06:46:12Z https://community.splunk.com/t5/Getting-Data-In/How-to-compare-IP-blacklists/m-p/450837#M78214 <P>There is an app for that called <CODE>Getwatchlist Add-on for Splunk Enterprise</CODE>:<BR /> <A href="https://splunkbase.splunk.com/app/635/">https://splunkbase.splunk.com/app/635/</A></P> Fri, 05 Jul 2019 23:32:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-compare-IP-blacklists/m-p/450837#M78214 woodcock 2019-07-05T23:32:05Z