https://community.splunk.com/t5/Splunk-Search/How-to-build-an-external-static-lookup-table-for-Firewall-ACL/m-p/173038#M49626 <P>Do you already have the lookup working for the matching ones? If yes, just use a <CODE>| fillnull -value "any_any" rule_name</CODE></P> Mon, 20 Oct 2014 23:46:58 GMT musskopf 2014-10-20T23:46:58Z https://community.splunk.com/t5/Splunk-Search/How-to-build-an-external-static-lookup-table-for-Firewall-ACL/m-p/173037#M49625 <P>Hello Splunk Answers,</P> <P>I am looking to build a static lookup table for Firewall ACL lookup. Essentially, I would like the lookup to match on dst_port and determine if the port matches an existing acl rule name. I have an any-any rule that I'm trying to clean-up and the idea is to have Splunk tell me if the dst_port matches an existing acl rule entry. If no rule match is made, then the connection is permitted via an any-any rule.</P> <P>I'm looking to match on dst_port. In this example, traffic connections on 80, 53 would match rule_name like in the example below. <BR /> fields:<BR /> dst_port, rule_name<BR /> 80, permit_web<BR /> 53, permit_dns</P> <P>The idea is, if traffic connections do not match on a specific entry, then state something like this:<BR /> dst_port, rule_name<BR /> 8748, any_any</P> <P>I appreciate the assistance.<BR /> -ktang</P> Mon, 28 Sep 2020 17:57:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-an-external-static-lookup-table-for-Firewall-ACL/m-p/173037#M49625 ktang 2020-09-28T17:57:03Z https://community.splunk.com/t5/Splunk-Search/How-to-build-an-external-static-lookup-table-for-Firewall-ACL/m-p/173038#M49626 <P>Do you already have the lookup working for the matching ones? If yes, just use a <CODE>| fillnull -value "any_any" rule_name</CODE></P> Mon, 20 Oct 2014 23:46:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-an-external-static-lookup-table-for-Firewall-ACL/m-p/173038#M49626 musskopf 2014-10-20T23:46:58Z https://community.splunk.com/t5/Splunk-Search/How-to-build-an-external-static-lookup-table-for-Firewall-ACL/m-p/173039#M49627 <P>That worked! thanks musskopf</P> Fri, 14 Nov 2014 19:20:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-an-external-static-lookup-table-for-Firewall-ACL/m-p/173039#M49627 ktang 2014-11-14T19:20:15Z