topic Re: lookup table in Splunk Search

lookup table

splunkyboy2 — Mon, 21 Sep 2020 14:08:29 GMT

can anyone help me with a lookup table

i have a 2 column lookup with column headings IPs and URLs, and i want to see if information in either csv field appears in the index data at all

some fields on the csv just have a url, some just have an ip , some both

is there a search string that will search the contents of either column against data held in index

Thanks in advance

Helppppp

Re: lookup table

gcusello — Mon, 21 Sep 2020 14:19:44 GMT

Hi @splunkyboy2,

you could run something like this:

Ciao.

Giuseppe

Re: lookup table

splunkyboy2 — Mon, 21 Sep 2020 14:31:37 GMT

Thanks for the reply, im new to splunk, so pardon my silly questions

how would i script a search that compares ether column of the lookup against data in the index using what you sent , would that be

thanks for your help

your_search ([ | inputlookup your_lookup | rename IP AS query | fields query ] OR [ | inputlookup your_lookup | rename URL AS query | fields query ])

Re: lookup table

gcusello — Mon, 21 Sep 2020 14:39:28 GMT

Hi @splunkyboy2,

if you rename a field in a subsearch "AS query", you use the results of the subsearch as free text search in the main search and not only in a field as usual.

You have to use two subsearches because you have two columns to use in the search.

Ciao.

Giuseppe

Re: lookup table

splunkyboy2 — Mon, 21 Sep 2020 14:42:12 GMT

so is this the search i need to run below ?

Re: lookup table

gcusello — Mon, 21 Sep 2020 15:06:28 GMT

hi @splunkyboy2,

yes, try this and see results, to understand if it's Ok or if you have to modify something:

Ciao.

Giuseppe

Re: lookup table

splunkyboy2 — Mon, 21 Sep 2020 15:10:56 GMT

i put an ip address i found in my data into the lookup to test the search, but it didnt bring back any results

as i dont really understand the search, its hard to see where its not working i guess

Re: lookup table

gcusello — Mon, 21 Sep 2020 15:19:32 GMT

Hi @splunkyboy2,

test the subsearches on by one.

Ciao.

Giuseppe

Re: lookup table

splunkyboy2 — Mon, 21 Sep 2020 16:38:40 GMT

i tried breaking it down , but no results

i have made a new lookup with two columns , one called info is a mix of ip addresses and urls, and the second column just has the word match against all fields

i tried the search index=xxxxxxx | inputlookup xxxxx.csv | rename info as query | fields query

should that work if anything in the info field is present in the data ?

Re: lookup table

gcusello — Tue, 22 Sep 2020 06:44:35 GMT

Hi @splunkyboy2,

maybe there a representation problem, but you have to use square brackets for subsearches (use Insert/Edit Code Cample for codes):

index=xxxxxxx [| inputlookup xxxxx.csv | rename info as query | fields query ] | ...

using only one colums obviously semplify your search.

Ciao.

Giuseppe

Re: lookup table

splunkyboy2 — Tue, 22 Sep 2020 07:04:44 GMT

it works using a single column ( match) lookup with the syntax below, thanks for all your help

index="wss_events" sourcetype=symantec:websecurityservice:scwss-poll [| inputlookup "WSSIOC4.csv" | rename match as query | fields query ]