Getting Data In

CSV Filter / Automated lookups issue. Need to NOT show items in CSV

ahucker
New Member

Hi All,

Relatively new to Splunk, but am making good progress.

I have a unique situation. I have an ASA logging its ACL deny entries to Splunk. All working great. I want to give some context around the issue. Currently I am migrating firewalls for a customer. We have a list of deny logs from the old firewall. Because this traffic is ALREADY being denied, we do not want to show it on the new firewall when we initially do the cutover. So essentially I need a NOT filter based on my CSV file.

Which raises another question, will Splunk match on source, dest, and port (all columns in my CSV) all as one search item, or does it match any of the three? I need it to match source, dest, and port as one.

I also have a CSV file that includes three columns. SourceIP, DestinationIP, and DestinationPort. I want Splunk to filter these when I search, and one of the two following things depending on what Splunk is capable of:

Do NOT show results matched in CSV file, but show everything else, or
Show results in CSV file as highlighted, and continue to show items not matched in CSV file.

From what I can tell so far I can get the CSV file to filter, but it ONLY shows me results matched, not the other data that was not matched. This kind of makes sense as what I want to do is somewhat backwards.

Any help would be fantastic.

Cheers.

Tags (1)
0 Karma

dart
Splunk Employee
Splunk Employee

Assuming you have a CSV file like this:

SourceIP,DestinationIP,DestinationPort,Status
127.0.0.1,127.0.0.1,8000,deny

Then search like so:

sourcetype=cisco_asa | lookup my_lookup_name SourceIP DestinationIP DestinationPort OUTPUT Status | search NOT Status=deny

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...