Is it possible to import a lot of IP addresses into a lookup list and search the lookup list without assigning the addresses to a specific field?
Basically I want to search from the lookup to act as if as I just typed 10.X.X.X into the search bar.
I know this isnt the best way to do it but right now I want to be able to search for that IP accross all indexes and each index have different field names for it
Hi @rtalcik,
it isn't possible to have a lookup without fields and there's no sense in this.
But if you want to run a search without fields or (better) in all the raw events, you can use this approach:
index=your_index [ | inputlookup your_lookup.csv | rename your_field AS query | fields query ]
| ...
in this way, the content of the your _field column of your_lookup.csv is searched in all the raw events in full text search mode.
Ciao.
Giuseppe
index=your_index [ | inputlookup your_lookup.csv | stats values(your_field) AS query | eval query=mvjoin(query, " OR ") |fields query ]
Just to be sure
Hi @rtalcik,
it isn't possible to have a lookup without fields and there's no sense in this.
But if you want to run a search without fields or (better) in all the raw events, you can use this approach:
index=your_index [ | inputlookup your_lookup.csv | rename your_field AS query | fields query ]
| ...
in this way, the content of the your _field column of your_lookup.csv is searched in all the raw events in full text search mode.
Ciao.
Giuseppe
okay so I would be able to add the list of IPs to the filed, rename the field then query off that for the search in raw event logs and such. ill try it
so need some help because it didnt work
sourcetype=cisco*
[| inputlookup EmotetIP.csv
| rename IP as query
| fields query
]
What I am trying to accomplish is basically building the list so I can set up an alert if a Log comes in that matches an IP in this list
What did not work?
Put an address that you know is in the cisco index into the CSV and try then to make sure you have a positive test.
cheers
afx