How do I get a Splunk conditional lookup command to match only specific values?

SplunkNewbie18 — Tue, 04 Dec 2018 15:39:44 GMT

Hi,

My search is based on 3 sources (firewall log, ioc feed macro and lookup table for ioc). To check for any match on ioc for the destip field.

index=firewall
| search [<macro>
| table destip
| format]
| lookup <lookup table> srcip as destip OUTPUT columnA as A
| lookup <lookup table> srcip as destip OUTPUT columnB as B
| table _time, destip, A, B

However, 1 ioc can have multiple row of data in the for column B:

destip-B
1.1.1.1-high  
1.1.1.1-low

Hence, the result of the above SPL will give me:

_time-destip-A-B
<time>-1.1.1.1-<output A>-high low

How do i include a condition to only lookup and match the ioc for only "high" events in column B in the lookup table, to be as below ouput?

_time-destip-A-B
<time>-1.1.1.1-<output A>-high

Re: How do I get a Splunk conditional lookup command to match only specific values?

skoelpin — Tue, 04 Dec 2018 16:19:42 GMT

I'll be the first to say this.. Your query is going to be painfully slow and will not scale, especially with firewall logs.

Instead, you should lump all 3 sources together like this

(index=firewall sourcetype=...) OR (index=...) 
| stats count by srcip
| lookup

Also, rather than using table, you should use a stats before the lookup for better performance

topic Re: How do I get a Splunk conditional lookup command to match only specific values? in Splunk Search

How do I get a Splunk conditional lookup command to match only specific values?

Re: How do I get a Splunk conditional lookup command to match only specific values?