Hi All,
Relatively new to Splunk, but am making good progress.
I have a unique situation. I have an ASA logging its ACL deny entries to Splunk. All working great. I want to give some context around the issue. Currently I am migrating firewalls for a customer. We have a list of deny logs from the old firewall. Because this traffic is ALREADY being denied, we do not want to show it on the new firewall when we initially do the cutover. So essentially I need a NOT filter based on my CSV file.
Which raises another question, will Splunk match on source, dest, and port (all columns in my CSV) all as one search item, or does it match any of the three? I need it to match source, dest, and port as one.
I also have a CSV file that includes three columns. SourceIP, DestinationIP, and DestinationPort. I want Splunk to filter these when I search, and one of the two following things depending on what Splunk is capable of:
Do NOT show results matched in CSV file, but show everything else, or
Show results in CSV file as highlighted, and continue to show items not matched in CSV file.
From what I can tell so far I can get the CSV file to filter, but it ONLY shows me results matched, not the other data that was not matched. This kind of makes sense as what I want to do is somewhat backwards.
Any help would be fantastic.
Cheers.
