The following 3 Correlation Searches within ES have the error
"lookup file is not populated":
The lookup file being referenced is "previously_seen_users_console_logins.csv "
When I look at the contents of the file, here is a redacted & trimmed down version of it:
Why is splunk stating the lookup file is not populated? Is the syntax incorrect?
If there is any documentation on how to set the file up correctly, I would greatly appreciate some guidance on where it is located.
You need to enable the scheduled report - 'ESCU - Previously seen users in CloudTrail' or run below query
sourcetype=aws:cloudtrail eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) | stats earliest(_time) as earliest latest(_time) as latest by user src City Region Country | outputlookup previously_seen_users_console_logins.csv | stats count
1. Are you getting result if you run (manually) 'ESCU - Previously seen users in CloudTrail' report
2. If yes, are getting result when you run (manually) any of below reports
Also, where you notice the error 'lookup file is not populated'? Can you share screenshot?
The error comes from configure > content management:
Unfortunately I can't upload another screenshot, as the attach picture only allows for a URL...
Thanks for the details. Even I get the same error in 'Content Management' page. But, when I run below query ( of 'Detect AWS Console Login by User from New City' Correlation report) manually after removing the 'where' condition, I get results. Can you try and update here whether you get results?
| inputlookup previously_seen_users_console_logins.csv | stats min(earliest) as earliest max(latest) as latest by user City | join user type=outer [| inputlookup previously_seen_users_console_logins.csv | stats min(earliest) AS earliestseen by user | fields earliestseen user] | eval userStatus=if(earliest >= relative_time(now(), "@d"), "New City","Previously Seen City") | eval UserData=if(earliestseen >= relative_time(now(), "@d") OR isnull(earliestseen), "New User","Old User") | convert ctime(earliest) ctime(latest) ctime(earliestseen) | table user City userStatus earliest latest earliestseen
I guess I'll be creating a case. The issue is we're using these lookups in Incident Response and we continue to receive alerts on users/cities/regions that we've whitelisted. My assumption is because Splunk believes the lookups are empty. I'm going to leave this open however in the meantime in case someone else has an answer or for when I get an update from Splunk about the issue, then I'll update this.