topic Comparing field value results to values(alphanumeric) in lookup file in Splunk Search

Comparing field value results to values(alphanumeric) in lookup file

harishkothandar — Wed, 30 May 2018 11:21:07 GMT

I am trying to compare the field values of a lookup file(alphanumeric values) to the my search results. Please help me with the search command. This is to compare file extensions with that of the blacklisted extensions and to create an alert when it matches.

Lookup :

Extensions Name
.xml XML
.py Python
.sh Shell

Comparing the extensions filed with the results that i get is what i need to do.

Re: Comparing field value results to values(alphanumeric) in lookup file

jkat54 — Wed, 30 May 2018 14:36:42 GMT

Try this:

Match what’s in the lookup:

 index=test [|inputlookup lookupname.csv | fields fieldFromLookup | format ]

Will turn into this:

index=test ((fieldFromLookup=valueFromRow1) OR (fieldFromLookup=valueFromRow2) ...)

If the field name in the lookup is different from the fiel name in your index, add a rename to the subseaech:

index=test [|inputlookup lookupname.csv | fields fieldFromLookup | rename fieldFromLookup as fieldInData | format ]