Splunk Enterprise Security

How to leverage multiple lookup tables in a search

Path Finder

I have two lookup tables:

notablesIp.csv and criticalAsset.csv

notableIP.csv
ip attack
1.1.1.1 Ransomware
1.1.1.2 Malware

CriticalAsset.csv
1.1.1.2
1.1.1.3

Desired results
1.1.1.2 Malware

How would I write a search that would tell me a notable happened on a critical asset?
They share a common field called IP.

1 Solution

Communicator

Try this search:

*| inputlookup notablesIP.csv
| join ip [| inputlookup CriticalAsset.csv ] *

View solution in original post

0 Karma

Ultra Champion
| inputlookup notablesIP.csv 
| inputlookup append=t  CriticalAsset.csv 
| selfjoin ip

I made a mistake. that's enough.

0 Karma

Communicator

I have never been able to get this search to work even though I see multiple references to just this search @to4kawa. What version of splunk are you using? Because in Splunk Enterprise 8.0.1 this search gets an error.

Error in 'inputlookup' command: This command must be the first command of a search.

Which is why I used the join command by the field ip.

0 Karma

Ultra Champion

I needed a sub search. I wonder if join is good this time.

0 Karma

Communicator

Try this search:

*| inputlookup notablesIP.csv
| join ip [| inputlookup CriticalAsset.csv ] *

View solution in original post

0 Karma

Path Finder

this is perfect also I added the lookup to the kv store so now it is
| inputlookup notableIP | join ip [| inputlookup CriticalAsset]
We are using Splunk ver 7.2

0 Karma