topic Re: Lookup Country Name in Splunk Search

Lookup Country Name

spIunk_user — Mon, 28 Sep 2020 19:53:27 GMT

Hi All,

I'm new to Splunk and have taken the Splunk Search/Reporting and Knowledge Objects courses - however this wasn't really part of them. I'm trying to lookup a Country name to a list of blacklisted countries. As we don't have the country names in the logs by default I need to use the iplocation command. The list itself lists the country in a field called blacklist_country and a y in the column blacklist_country_match (to show it is blacklisted).

I have verified with the inputlookup command the file appears and is formatted as it should be.

I know that to actually have the country names present I need to do the iplocation command - so far I have the following which displays perfectly:

sourcetype="ASA" | iplocation prefix=src_ip_ src_ip | iplocation prefix=dest_ip_ dest_ip

This causes the country names to show up as src_ip_Country and dest_ip_Country.

However, when I do lookups to the table for matches I just get errors. Using this (just for src_ip_Country to start out with):

sourcetype="ASA" earliest=-2h | iplocation prefix=src_ip_ src_ip | lookup blacklistCountries blacklist_country as src_ip_Country OUTPUT blacklist_country_match as src_blacklist_country_match

I've tried adding the .csv to the end of the file name within the lookup command as well as trying OUTPUTNEW.

I'd appreciate any advise on what I'm missing or even whether there is a better or more efficient way to go about this. Also, if anyone has suggestions on actually making this an auto-lookup. I assume the error has something to do with the country names not being in the logs by default and me having to call them in the same search, but I assumed that as I called them prior to the lookup it would have worked out.

Thanks!

Re: Lookup Country Name

spIunk_user — Tue, 12 May 2015 21:08:38 GMT

Also this is 6.2 and everything is in my personal directory.

Re: Lookup Country Name

lguinn2 — Wed, 13 May 2015 06:36:35 GMT

What is in your blacklisted countries CSV file? What errors are you seeing?

Re: Lookup Country Name

woodcock — Wed, 13 May 2015 23:30:09 GMT

What are the headers for your lookup CSV? According to your lookup here:

sourcetype="ASA" earliest=-2h | iplocation prefix=src_ip_ src_ip | lookup blacklistCountries blacklist_country as src_ip_Country OUTPUT blacklist_country_match as src_blacklist_country_match

The format for the command is:

lookup &lt;lookup-table-name&gt; &lt;lookup-field1&gt; AS &lt;event-field1&gt;, &lt;lookup-field2&gt; AS &lt;event-field2&gt; OUTPUT &lt;lookup-destfield1&gt; AS &lt;event-destfield1&gt;, &lt;lookup-destfield2&gt; AS &lt;event-destfield2&gt;

So according to this mapping, your file has this header:

src_ip_Country,blacklist_country_match

But I suspect that this is not the case in your file.