topic Re: Lookup works on one instance, but not another in Splunk Search

Lookup works on one instance, but not another

jwalzerpitt — Wed, 07 Feb 2018 13:51:55 GMT

I'm seeing a weird issue - I have two Splunk instances, one for prod and one for dev. I have a lookup created that looks for an IP and then compares it to the lookup list to see what CIDR it falls into and then extracts the firewall zone it's in. Here's a search I run in prod that works (returns the firewall zone):

index=foo sourcetype="foo"
| lookup ip_cidr.csv cidr_range as IP_Address
| eval firewall=coalesce(firewall,"null")
| eval context=coalesce(context,"null")
| eval zone=coalesce(zone,"null")
| stats count by IP_Address,zone
| fieldformat count=tostring(count,"commas") 
| sort -count

I get a list of IPs with the zone and the count

On dev, I'm running a similar search against our DNS logs:

index=bind `dns_whitelist`
| lookup ip_cidr.csv cidr_range as src
| eval firewall=coalesce(firewall,"null")
| eval context=coalesce(context,"null")
| eval zone=coalesce(zone,"null")
| stats count by src,zone,query
| fieldformat count=tostring(count,"commas") 
| sort -count

However, for this search the zone is returned as "null" for every IP. I verified the permissions for both the lookup file and the lookup definition and they're both set to Global and All apps.

I'm just at a loss as to what the difference is between the two. Any help would be appreciated.

Thx

Re: Lookup works on one instance, but not another

mdsnmss — Tue, 29 Sep 2020 18:01:12 GMT

Run |input lookup ip_cidr.csv. Are the lookup tables the same on each instance? Does the lookup field "cidr_range" exist in your dev search? You can run just index=bind 'dns_whitelist' to check that. It seems like the lookup isn't finding anything and is reverting to a default value of null based on the lookup definition. The issues seems to point to a difference in fields between the two logs.

Re: Lookup works on one instance, but not another

Yunagi — Wed, 07 Feb 2018 14:12:49 GMT

Have you checked the "Match type" setting for your lookup definitions? You need to click on "Advanced options" when editing a lookup definition to make it visible.
I believe the match type for your first lookup definition (prod) should be: CIDR(IP_Address)
For the second lookup definition (dev), it should be: CIDR(src)

Re: Lookup works on one instance, but not another

jwalzerpitt — Wed, 07 Feb 2018 14:16:30 GMT

I ran | inputlookup ip_cidr.csv on both instances and I'm seeing the same results - 2,439 results - on both instances.

Thx

Re: Lookup works on one instance, but not another

jwalzerpitt — Wed, 07 Feb 2018 14:19:25 GMT

Thx Yunagi - that was it!

Re: Lookup works on one instance, but not another

Yunagi — Wed, 07 Feb 2018 14:44:33 GMT

You're welcome. 🙂