topic Re: Add columns from lookup file in Splunk Search

Add columns from lookup file

ronj_clark — Wed, 22 Jan 2025 19:23:26 GMT

Combing through firewall logs. I am extracting source, destination, dest_port.

I have a csv lookup file with ports and descriptions of those ports, both udp and tcp. I want to take the description from the lookup and add to the results in a table.

Here is my search:

| stats count by SRC, DST, DEST_PORT | lookup tcp-udp description OUTPUT description AS desc, port | eval desc=if(DPT = port, description, "not ok") | table SRC, DST, DEST_PORT, port, desc

the port and desc field are blank and say "not ok" respectively. I'm stuck...

Re: Add columns from lookup file

VatsalJagani — Wed, 22 Jan 2025 19:06:16 GMT

There is minor issue with the lookup command syntax.

| lookup tcp-udp port OUTPUT description

after lookup name there should be the field which is common between lookup and splunk data, which in our case is port number.

Lookup Command Doc - https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup

I hope this helps!!! Kindly upvote if it does!!

Re: Add columns from lookup file

richgalloway — Wed, 22 Jan 2025 19:12:22 GMT

You're asking the lookup command to find the description field, but the field doesn't exist yet. The lookup command needs an input field which it will then search for in the given lookup table. It returns the requested fields that are in the same row as the located input field.

In the example, we probably want the description associated with the destination port. If so, the command might look like this

| lookup tcp-udp DEST_PORT as port OUTPUT description AS desc, port

Also, the DPT field in the eval command doesn't exist so the if will always evaluate to false.