topic Re: Design a search for find list intersection of kvstore and inndex and put them to summary index in Splunk Search

Design a search for find list intersection of kvstore and inndex and put them to summary index

Daniel_Pham — Wed, 26 May 2021 10:48:46 GMT

I'm new to Splunk And I'm trying to build summary index

i have KVStore and index

A: inputlookup spam_ip (which is Indicator of compromise)

B: index=main (which is event log)

Both indexes have a field that has the same data:

eg: A has a field (spam_ip), B has a field (source_ip)

And populate all record in set A that the record have data field contain in set B into summary index

Re: Design a search for find list intersection of kvstore and inndex and put them to summary index

richgalloway — Wed, 26 May 2021 12:45:05 GMT

it would help to know what you've tried so far and what the results were, but perhaps this will help:

index=main [ | inputlookup spam_ip | rename spam_ip as source_ip | fields source_ip | format ]

Re: Design a search for find list intersection of kvstore and inndex and put them to summary index

Daniel_Pham — Wed, 26 May 2021 13:39:17 GMT

it works, thank you !!

Re: Design a search for find list intersection of kvstore and inndex and put them to summary index

Daniel_Pham — Wed, 26 May 2021 14:04:57 GMT

it works but when i tried this

| inputlookup ts_lookup_destip (index=main | rename ip as srcip | fields srcip | format)

i get an error

The result i want is which indicator of compromise (include all fields) is used to detect

Re: Design a search for find list intersection of kvstore and inndex and put them to summary index

richgalloway — Wed, 26 May 2021 14:13:07 GMT

What error do you get? It must be syntax related since that query is not valid SPL. Replacing the square brackets with parentheses completely changes the query. Did you try the same query with square brackets?

Re: Design a search for find list intersection of kvstore and inndex and put them to summary index

Daniel_Pham — Wed, 26 May 2021 14:16:57 GMT

when i tried this

| inputlookup ts_lookup_destip [index=main | rename ip as srcip | fields srcip | format]

i get Unknown search command 'index'.

Re: Design a search for find list intersection of kvstore and inndex and put them to summary index

Daniel_Pham — Wed, 26 May 2021 16:02:33 GMT

i got it with this

| inputlookup spam_ip | join srcip [ search index=main | rename ip as srcip | fields srcip ]

thank you for your time

Re: Design a search for find list intersection of kvstore and inndex and put them to summary index

richgalloway — Wed, 26 May 2021 17:27:32 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.