How to reload inputlookup csv file used in a saved realtime search



i am using serveral saved realitime searches for detecting bad requests on the webservers. To exclude some ip addresses, I saved them in a csv file and included it with the command "inputlookup".

For example:

source="/var/log/httpd/vhost.log" uri_query="*bad_keyword*" NOT [ | inputlookup www_ip_whitelist.csv] | top limit=100 clientip | search count>10

As I understood the csv file is only readed once, when the search is saved. What should I do, if I have an updated list in the csv file?

Now I am disableing and reenable the saved searches.

Tags (2)


The trouble here is not with inputlookup but rather with subsearches. Those are evaluated first, and the main search is launched after that.

You could define your lookup as a regular automatic lookup and filter based on that. Might degrade search performance a little, but should work with realtime searches. Say your lookup contains a list of IPs, add a field whitelist=1 to each and search like this:

source="/var/log/httpd/vhost.log" uri_query="*bad_keyword*" NOT whitelist=1 | top ...

Didn't test whether this handles reloading a changed lookup file though.

0 Karma

Revered Legend
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!