Splunk Enterprise Security
Highlighted

How to build a lookup list without fields

Path Finder

Is it possible to import a lot of IP addresses into a lookup list and search the lookup list without assigning the addresses to a specific field?

Basically I want to search from the lookup to act as if as I just typed 10.X.X.X into the search bar.

I know this isnt the best way to do it but right now I want to be able to search for that IP accross all indexes and each index have different field names for it

0 Karma
Highlighted

Re: How to build a lookup list without fields

Legend

Hi @rtalcik,
it isn't possible to have a lookup without fields and there's no sense in this.
But if you want to run a search without fields or (better) in all the raw events, you can use this approach:

index=your_index [ | inputlookup your_lookup.csv | rename your_field AS query | fields query ]
| ...

in this way, the content of the your field column of yourlookup.csv is searched in all the raw events in full text search mode.

Ciao.
Giuseppe

View solution in original post

0 Karma
Highlighted

Re: How to build a lookup list without fields

Path Finder

okay so I would be able to add the list of IPs to the filed, rename the field then query off that for the search in raw event logs and such. ill try it

0 Karma
Highlighted

Re: How to build a lookup list without fields

Path Finder

so need some help because it didnt work

sourcetype=cisco*
[| inputlookup EmotetIP.csv
| rename IP as query
| fields query
]

What I am trying to accomplish is basically building the list so I can set up an alert if a Log comes in that matches an IP in this list

0 Karma
Highlighted

Re: How to build a lookup list without fields

Contributor

What did not work?
Put an address that you know is in the cisco index into the CSV and try then to make sure you have a positive test.
cheers
afx

0 Karma
Highlighted

Re: How to build a lookup list without fields

Ultra Champion
 index=your_index [ | inputlookup your_lookup.csv | stats values(your_field) AS query | eval query=mvjoin(query, " OR ") |fields query ]

Just to be sure

0 Karma