I have two lookup tables:
notablesIp.csv and criticalAsset.csv
notableIP.csv
ip attack
1.1.1.1 Ransomware
1.1.1.2 Malware
CriticalAsset.csv
1.1.1.2
1.1.1.3
Desired results
1.1.1.2 Malware
How would I write a search that would tell me a notable happened on a critical asset?
They share a common field called IP.
Try this search:
*| inputlookup notablesIP.csv
| join ip [| inputlookup CriticalAsset.csv ] *
| inputlookup notablesIP.csv
| inputlookup append=t CriticalAsset.csv
| selfjoin ip
I made a mistake. that's enough.
I have never been able to get this search to work even though I see multiple references to just this search @to4kawa. What version of splunk are you using? Because in Splunk Enterprise 8.0.1 this search gets an error.
Error in 'inputlookup' command: This command must be the first command of a search.
Which is why I used the join
command by the field ip
.
I needed a sub search. I wonder if join
is good this time.
Try this search:
*| inputlookup notablesIP.csv
| join ip [| inputlookup CriticalAsset.csv ] *
this is perfect also I added the lookup to the kv store so now it is
| inputlookup notableIP | join ip [| inputlookup CriticalAsset]
We are using Splunk ver 7.2