topic How do I edit my search to compare a list of IPs from a lookup to IPs in firewall logs? in Splunk Search

How do I edit my search to compare a list of IPs from a lookup to IPs in firewall logs?

CYBR_AH — Wed, 04 Nov 2015 22:45:41 GMT

I'm still new to Splunk and trying to figure out the correct syntax for lookups.

My goal is to compare a list of known IPs associated with a botnet and see if there is any traffic to/from the IPs in the firewall logs.

index=firewall_logs sourcetype=cisco:asa [ | inputlookup bad_ips.csv | fields IP ]

This returns nothing. What else am I missing? Thanks in advance!

MuS — Wed, 04 Nov 2015 23:24:11 GMT

Hi CYBR_AH,

run the search using return instead fields :

index=firewall_logs sourcetype=cisco:asa | [ | inputlookup bad_ips.csv | return 999 IP ]

This will return the results from the lookup file as this string:

(IP="1.1.1.1") OR (IP="2.2.2.2") ....

which will be used in the base search, so the search be in the end:

index=firewall_logs sourcetype=cisco:asa (IP="1.1.1.1") OR (IP="2.2.2.2") ....

Hope this helps ...

cheers, MuS

Update:

Sorry the first one was wrong! Try this instead:

 | inputlookup bad_ips.csv | search [ search index=firewall_logs sourcetype=cisco:asa | dedup IP | fields IP ]

Hope this makes more sense ...

MuS — Wed, 04 Nov 2015 23:34:37 GMT

update ping...

CYBR_AH — Thu, 05 Nov 2015 04:35:07 GMT

I tried

index=firewall_logs sourcetype=cisco:asa | [ | inputlookup bad_ips.csv | return 999 $IP] | stats count by dest_ip

and it worked. This gave me a really good starting point. Thanks for your help! 🙂

vinitashinde94 — Thu, 25 Jul 2019 12:36:32 GMT

where do ve upload .csv file in splunk which contains list of IPs?