topic Re: Splunk query filtering on lookup table csv in Splunk Search

Splunk query filtering on lookup table csv

vfm — Wed, 08 Oct 2014 12:33:31 GMT

Hello,

I have a query which shows me whether malicious sites have been accessed per client ip:

"Potentially Unwanted Software" OR "Gambling" OR "Suspicious" OR "Scam/Questionable/Illegal" OR "Proxy Avoidance" | stats count by src_ip | sort count desc

I also to have those categories in a lookup table:

Potentially Unwanted Software
Gambling
Suspicious
Scam/Questionable/Illegal
Proxy Avoidance"

I would like to have a query like this:

lookup malicious_sites.csv | search * | stats count by src_ip | sort count desc

Somehow it is not working, can you guys help me out what I'm doing wrong?

Re: Splunk query filtering on lookup table csv

Ayn — Wed, 08 Oct 2014 12:40:03 GMT

lookup doesn't work like that. You should read the docs on the lookup command and the inputlookup command.

What you want is probably something like this (assuming your field for this is called "category" in both the lookup and your events):

[inputlookup malicious_sites.csv | fields category] | stats count by src_ip | sort - count

Re: Splunk query filtering on lookup table csv

vfm — Wed, 08 Oct 2014 13:29:51 GMT

Hello Ayn,

thanks for you response.
I tried your query, because it looked exactly like what I wanted. And yes, in both my lookup and the events the field is category
However it returns no results, whereas when I put the categories in my query, I do get results.

This happens also when I try examples I find in the documentation. Somehow there is still something incorrect.

Regards,
V

Re: Splunk query filtering on lookup table csv

Akili — Wed, 24 Dec 2014 13:17:24 GMT

me too, no results found