I have a look up table with two columns. They are for source IP and destination IP addresses. I want to be able to search for firewall traffic logs and filter out any source IP and destination IP combination from the results.
The following query allows for excluding source_ip from the lookup table. How would I be able to exclude source_ip and destination_ip combination?
index=firewall sourcetype=<source_type> NOT [ | inputlookup test.csv
table source_ip]
| table _time, source_ip, destination_ip, action, protocol
Thanks.
When you read from the lookup file, include both the source and destination IP addresses. The trick then is to use the format command to build a search string in the form (src_ip=1.2.3.4 AND dest_ip=5.6.7.8). It's important to ensure the field names returned by the subsearch match field names available in the main search.
index=firewall sourcetype=<source_type> NOT [ | inputlookup test.csv
fields source_ip destination_ip | format maxresults=0 ]
| table _time, source_ip, destination_ip, action, protocol
When you read from the lookup file, include both the source and destination IP addresses. The trick then is to use the format command to build a search string in the form (src_ip=1.2.3.4 AND dest_ip=5.6.7.8). It's important to ensure the field names returned by the subsearch match field names available in the main search.
index=firewall sourcetype=<source_type> NOT [ | inputlookup test.csv
fields source_ip destination_ip | format maxresults=0 ]
| table _time, source_ip, destination_ip, action, protocol