https://community.splunk.com/t5/Splunk-Search/How-to-search-comunication-between-a-inputlookup-with-some-ip-s/m-p/371126#M164042 <P>Hi lguinn, thanks for your answer. </P> <P>i add some data, thanks. </P> <P>What are you trying to accomplish? Do you want to see events from your indexes that match the ip addresses in the lookup table?<BR /><BR /> <STRONG>Yeah, i'm looking if some ip are doing match with the data from the inputlookp because the ip´s are identify like bad ip's, and the input only have two fields: ip and info.</STRONG> <BR /> What data is in the lookup table? Is it just a list of ip addresses? <BR /> <STRONG>In the input are ip´s identify as indicator of compromise from a botnet.</STRONG> <BR /> What data is in the indexes?<BR /> <STRONG>In the index are logs from a firewall with fiel like ip_src, ip_dst, service, protocol, etc...</STRONG></P> Tue, 29 Sep 2020 17:29:02 GMT Said7 2020-09-29T17:29:02Z https://community.splunk.com/t5/Splunk-Search/How-to-search-comunication-between-a-inputlookup-with-some-ip-s/m-p/371122#M164038 <P>Hi, I have a doubt about an inputlookup, i have a inputlookup with some ip's and i want to know how can see comunication between my input and traffic from others indexes? </P> Wed, 03 Jan 2018 16:00:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-comunication-between-a-inputlookup-with-some-ip-s/m-p/371122#M164038 Said7 2018-01-03T16:00:29Z https://community.splunk.com/t5/Splunk-Search/How-to-search-comunication-between-a-inputlookup-with-some-ip-s/m-p/371123#M164039 <P>The index are from a Firewall and i want search comunication between them, and then make a table with some interenting fields.</P> Wed, 03 Jan 2018 16:05:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-comunication-between-a-inputlookup-with-some-ip-s/m-p/371123#M164039 Said7 2018-01-03T16:05:03Z https://community.splunk.com/t5/Splunk-Search/How-to-search-comunication-between-a-inputlookup-with-some-ip-s/m-p/371124#M164040 <P>There is no "communication" between data in Splunk.</P> <P>If you have a lookup table, you can use the inputlookup command (along with other commands) to combine the lookup table data with the events retrieved from indexes.</P> <P>However, this is a very general statement. There is no way to answer your question without more details.</P> <P>What are you trying to accomplish? Do you want to see events from your indexes that match the ip addresses in the lookup table? <BR /> What data is in the lookup table? Is it just a list of ip addresses? <BR /> What data is in the indexes?</P> <P>If you can answer these questions, and provide a bit of sample data, the community can help.</P> Wed, 03 Jan 2018 20:15:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-comunication-between-a-inputlookup-with-some-ip-s/m-p/371124#M164040 lguinn2 2018-01-03T20:15:20Z https://community.splunk.com/t5/Splunk-Search/How-to-search-comunication-between-a-inputlookup-with-some-ip-s/m-p/371125#M164041 <P>Said7, are you asking how to use a lookup table and incorporate it into a search of the Firewall traffic that you have being sent to your Splunk instance?</P> <P>Thanks!<BR /> Glenn</P> Wed, 03 Jan 2018 20:24:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-comunication-between-a-inputlookup-with-some-ip-s/m-p/371125#M164041 gmchenry 2018-01-03T20:24:22Z https://community.splunk.com/t5/Splunk-Search/How-to-search-comunication-between-a-inputlookup-with-some-ip-s/m-p/371126#M164042 <P>Hi lguinn, thanks for your answer. </P> <P>i add some data, thanks. </P> <P>What are you trying to accomplish? Do you want to see events from your indexes that match the ip addresses in the lookup table?<BR /><BR /> <STRONG>Yeah, i'm looking if some ip are doing match with the data from the inputlookp because the ip´s are identify like bad ip's, and the input only have two fields: ip and info.</STRONG> <BR /> What data is in the lookup table? Is it just a list of ip addresses? <BR /> <STRONG>In the input are ip´s identify as indicator of compromise from a botnet.</STRONG> <BR /> What data is in the indexes?<BR /> <STRONG>In the index are logs from a firewall with fiel like ip_src, ip_dst, service, protocol, etc...</STRONG></P> Tue, 29 Sep 2020 17:29:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-comunication-between-a-inputlookup-with-some-ip-s/m-p/371126#M164042 Said7 2020-09-29T17:29:02Z https://community.splunk.com/t5/Splunk-Search/How-to-search-comunication-between-a-inputlookup-with-some-ip-s/m-p/371127#M164043 <P>Hi Glenn, yeah i want to incorporate a search with the index from the Firewall and the inputlookup. In the input are ip´s identified as a part of a botnet. And in the index are data from a firewall. First i want to see if there are comunication between the internal ip´s with the ip´s from the inputlookup and then could be create a dashboard or an alert. </P> <P>Thanks for you help. </P> Wed, 03 Jan 2018 21:12:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-comunication-between-a-inputlookup-with-some-ip-s/m-p/371127#M164043 Said7 2018-01-03T21:12:13Z https://community.splunk.com/t5/Splunk-Search/How-to-search-comunication-between-a-inputlookup-with-some-ip-s/m-p/371128#M164044 <P>This <A href="https://answers.splunk.com/answers/608116/palo-alto-inputlookup-errors.html">recent answers post</A> may help you.</P> <P>It contains a nice detailed example of searching IP address indicators from a lookup file.</P> Wed, 03 Jan 2018 21:14:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-comunication-between-a-inputlookup-with-some-ip-s/m-p/371128#M164044 micahkemp 2018-01-03T21:14:54Z