How to reload inputlookup csv file used in a saved realtime search



i am using serveral saved realitime searches for detecting bad requests on the webservers. To exclude some ip addresses, I saved them in a csv file and included it with the command "inputlookup".

For example:

source="/var/log/httpd/vhost.log" uri_query="*bad_keyword*" NOT [ | inputlookup www_ip_whitelist.csv] | top limit=100 clientip | search count>10

As I understood the csv file is only readed once, when the search is saved. What should I do, if I have an updated list in the csv file?

Now I am disableing and reenable the saved searches.

Tags (2)


The trouble here is not with inputlookup but rather with subsearches. Those are evaluated first, and the main search is launched after that.

You could define your lookup as a regular automatic lookup and filter based on that. Might degrade search performance a little, but should work with realtime searches. Say your lookup contains a list of IPs, add a field whitelist=1 to each and search like this:

source="/var/log/httpd/vhost.log" uri_query="*bad_keyword*" NOT whitelist=1 | top ...

Didn't test whether this handles reloading a changed lookup file though.

0 Karma

Revered Legend
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...