Splunk query on lookups

umeshcreddy — Tue, 14 Dec 2021 15:43:10 GMT

Actually i made lookup with the list of ip address in .csv file. I want to write a query if there is traffic from the ip address which i had given in the lookups.

Please help me woth the query. i have the Web datamodel as well

Thanks & Regards,

Umesh Chandra Reddy

Re: Splunk query on lookups

ldongradi_SPL — Tue, 14 Dec 2021 17:47:27 GMT

You don't say where the traffic analysis comes from ... Any index, source, sourcetype ?

Do you want to analyze the activity toward the Splunk Web server itself ? If so, you would start looking in

index=_internal  source=splunkd_access.log sourcetype=splunkd_ui_access clientip=*

Here the clientip is the field that tells you about the incoming connection.

If you want to compare it with the lookup you can then add this :

... | LOOKUP <lookup.csv/lookup definition> clientip OUTPUTNEW clientip AS knownIP

If the ip address is in the csv, then it will be shown in the knownIP field.

If it is unknown, the knownIP field will be inexistent.

After what you can filter the results based on the existence of that knownIP field, with:

| where isnull(knownIP)

| where isnotnull(knownIP)

topic Splunk query on lookups in Splunk Search

Splunk query on lookups

Re: Splunk query on lookups