Splunk Dev

Matching values in fields from multiple sources

Zyon
Engager

I have two different sources, blacklisted and log. blacklisted source contains all the blacklisted IP Addresses, and log source contains network information of potential sources.

Below is the search command i use, together with the results obtained.

sourcetype="Blacklist" OR sourcetype="log" | eval blacklisted=if(sourcetype=="Blacklist",_raw,null()) | fields - _* | fields blacklisted,SRC 

Results: http://tinypic.com/r/11mc5z8/5

What i need to do is to compare the two fields and display which are the IP address that matches, in order words, which IP address in my log matches the blacklisted IP address in my blacklisted.

What i tried doing to get the matching field is to use the below command

sourcetype="Blacklist" OR sourcetype="log" | eval blacklisted=if(sourcetype=="Blacklist",_raw,null()) | fields - _* | fields blacklisted,SRC | eval matches=if(blacklisted==SRC, "match", "no match") 

Results: http://tinypic.com/r/10e1q2b/5

What i assume is that they are matching the field SRC which is null, to the field blacklisted, and therefore, return no matches.

May i ask if there is any suggestion to solve this problem?

Thank You.

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Sounds to me like you should be setting up a lookup containing your blacklisted IP addresses, and then match using that lookup. I'm not really following how your current searches are meant to work - I suspect that you're confusing how some things work in Splunk.

View solution in original post

0 Karma

Ayn
Legend

Sounds to me like you should be setting up a lookup containing your blacklisted IP addresses, and then match using that lookup. I'm not really following how your current searches are meant to work - I suspect that you're confusing how some things work in Splunk.

0 Karma

Zyon
Engager

Oh thanks! I think i know how to make it work. Thanks!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...