Splunk Enterprise Security

My search isnt showing data from lookup list

rtalcik
Path Finder

What my search is trying to do is whenever the search matches an item in the lookup list it should display the results which I can turn into an alert. however, it is not working or displaying results and I cant figure out why

(index=cisco* OR index=proxy)
dest_ip="" OR domain=""
| rename dest_ip as emotet_ip
| rename domain as emotet_domain
| where
[| inputlookup emotet-lookup
| fields emotet_ip , emotet_domain]
| stats values(emotet_ip) as emotetIP, values(emotet_domain) as emotetDomain

0 Karma

rtalcik
Path Finder

thanks for answering -- however I ALWAYS have this this problem when i do it that way


Last 24 hours
Error in 'lookup' command: Must specify one or more lookup fields.
The search job has failed due to an error. You may be able view the job in the Job Inspector.

and it is specifying a field in the lookup table

0 Karma

Richfez
SplunkTrust
SplunkTrust

Oh goodness, you are inputlookup'ing and smashing together data you can just 'lookup'.

(index=cisco* OR index=proxy) dest_ip="" OR domain=""
| rename dest_ip as emotet_ip
| rename domain as emotet_domain
| lookup emotet-lookup OUTPUT emotetDomain

That should match all matching fields up, and return emotetDomain from them. Simply and quickly.

0 Karma

rtalcik
Path Finder

i posted -- i always have an issue with your method.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...