topic How to match on value NOT in lookup table in Splunk Search

How to match on value NOT in lookup table

DEADBEEF — Fri, 14 Jan 2022 08:15:14 GMT

I have a list of IP addresses in a lookup table that are network scanners.

I am trying to build a search that excludes the IP addresses in this lookup table, but for some reason my search keeps including IP address values that are clearly present in the lookup. I tried putting the quotes around the IP addresses ("1.2.3.4"), tried without quotes (1.2.3.4) but nothing works. The raw data does not have quotes. After having tried enough combinations, I am hoping someone can help me. Eventually, I'll be adding the remaining IP's to the lookup table via OUTPUTLOOKUP append=true but until I can get this working... I'm stuck.

index=foo sourcetype=bar NOT [| inputlookup network_scanners | table IpAddress] | dedup IpAddress | table IpAddress

Re: How to match on value NOT in lookup table

ITWhisperer — Fri, 14 Jan 2022 08:20:53 GMT

Have you tried format?

Re: How to match on value NOT in lookup table

DEADBEEF — Fri, 14 Jan 2022 08:51:29 GMT

That was the fix! What about the format command resolved this?

Re: How to match on value NOT in lookup table

ITWhisperer — Fri, 14 Jan 2022 09:51:42 GMT

It formats the events returned by the inputlookup into a string like

((IpAddress="1.1.1.1") OR (IpAddress="2.2.2.2"))

so it can be used as part of the (initial) search

Re: How to match on value NOT in lookup table

DEADBEEF — Fri, 14 Jan 2022 15:16:25 GMT

Ahh okay. Is this because the IP address has minor breakers so if you don't use format then it doesn't work as expected? Just curious as I never had to use it before (but was never matching against IP's).

Re: How to match on value NOT in lookup table

ITWhisperer — Fri, 14 Jan 2022 16:00:59 GMT

Essentially, yes. As I understand it, splunk will sometimes break things up by punctuation so 1.1.1.1 it treated as up to 4 separate strings.