Splunk Search

Add columns from lookup file

ronj_clark
Explorer

Combing through firewall logs.  I am extracting source, destination, dest_port.  

I have a csv lookup file with ports and descriptions of those ports, both udp and tcp.   I want to take the description from the lookup and add to the results in a table. 

Here is my search:

| stats count by SRC, DST, DEST_PORT
| lookup tcp-udp description OUTPUT description AS desc, port
| eval desc=if(DPT = port, description, "not ok")
| table SRC, DST, DEST_PORT, port, desc

the port and desc field are blank and say "not ok" respectively.  I'm stuck...

 

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You're asking the lookup command to find the description field, but the field doesn't exist yet.  The lookup command needs an input field which it will then search for in the given lookup table.  It returns the requested fields that are in the same row as the located input field.

In the example, we probably want the description associated with the destination port.  If so, the command might look like this

| lookup tcp-udp DEST_PORT as port OUTPUT description AS desc, port

 Also, the DPT field in the eval command doesn't exist so the if will always evaluate to false.

---
If this reply helps you, Karma would be appreciated.

VatsalJagani
SplunkTrust
SplunkTrust

There is minor issue with the lookup command syntax.

| lookup tcp-udp port OUTPUT description

 

after lookup name there should be the field which is common between lookup and splunk data, which in our case is port number.

 

Lookup Command Doc - https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup

 

I hope this helps!!! Kindly upvote if it does!!

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...