topic Why are exclusions using lookup failing? in Splunk Search

Why are exclusions using lookup failing?

rgarcia — Fri, 24 Jul 2020 22:30:56 GMT

I'm looking signatures in snort but I want to exclude some of the signature IDs by using inputlookup, but it doesn't seem to exclude them.

My search

index=security-snort sourcetype="snort" | search NOT [ | inputlookup SnortSigEx.csv ] | stats values(name) as name by signature | dedup signature

Re: Exclusions using lookup fails

to4kawa — Fri, 24 Jul 2020 22:11:44 GMT

Re: Exclusions using lookup fails

rgarcia — Fri, 24 Jul 2020 22:40:03 GMT

Thanks for replying, but unfortunetely I'm still seeing the IDs in the search results...which are supposed to be excluded.

Does the lookup file need to be in a certain format (header names)? Permission are set to all apps and for admin and power users

Note: I'm an Admin

Re: Exclusions using lookup fails

to4kawa — Fri, 24 Jul 2020 22:51:18 GMT

please provide CSV and search detail.

Re: Exclusions using lookup fails

rgarcia — Fri, 24 Jul 2020 23:03:49 GMT

Re: Exclusions using lookup fails

gcusello — Sat, 25 Jul 2020 06:06:33 GMT

Hi @rgarcia,

I suppose that the field name of the signature ID is signature in both the security-snort index and lookup, in this case try, please, something like this:

index=security-snort sourcetype="snort" NOT [ | inputlookup SnortSigEx.csv | fields signature ] | stats values(name) as name by signature

If instead tyhe field name s are different and you have ID in the security-snort index and fields1 in lookup, in this case try, please, try this:

index=security-snort sourcetype="snort" NOT [ | inputlookup SnortSigEx.csv | rename column1 AS ID | fields ID ] | stats values(name) as name by ID

Ciao.

Giuseppe

Re: Exclusions using lookup fails

rgarcia — Mon, 27 Jul 2020 15:20:57 GMT

Thanks for replying, but unfortunately neither worked as the search returned all the values ignoring the input lookup file to exclude the sig id.

Is there another way to exclude multiple values?

Re: Exclusions using lookup fails

gcusello — Mon, 27 Jul 2020 15:37:03 GMT

Hi @rgarcia,

could you share:

a sample of your logs where there's the "53590" signature? (You can take it in the events tab),
the lookup column names,
the "53590" value in lookup.

Then, could you check what's the field name of signature in security-snort index and lookup (field names are case sensitive)?

Ciao.

Giuseppe

Re: Exclusions using lookup fails

rgarcia — Mon, 27 Jul 2020 15:43:36 GMT

I already provided that info in my previous posts.

Re: Exclusions using lookup fails

rgarcia — Mon, 27 Jul 2020 15:45:22 GMT

Here is the field from the events

Re: Exclusions using lookup fails

gcusello — Mon, 27 Jul 2020 15:48:34 GMT

Hi @rgarcia,

Sorry I forgot it!

Anyway, the field name of signature in Lookup isn't signature but Column1, so you have to rename it in lookup or in the search.

if in the search, try this please:

index=security-snort sourcetype="snort" NOT [ | inputlookup SnortSigEx.csv | rename column1 AS signature | fields signature ] | stats values(name) as name by signature

To use a lookup to exclude or include values in a search, the field names must be the same in both the main search and the lookup.

Ciao.

Giuseppe

Re: Exclusions using lookup fails

rgarcia — Mon, 27 Jul 2020 19:59:49 GMT

Thank you, just had to use upper-case "c" and it worked.

Re: Exclusions using lookup fails

gcusello — Tue, 28 Jul 2020 06:51:00 GMT

Hi @rgarcia,

Good!

Please accept the answer fo the other people of the Community.

Ciao and next time!

Giuseppe

P.S.: Karma Points are appreciated 😉