Splunk Search

Can I use lookup for whitelisting based on 2 columns?

izzie123
Explorer

I have to whitelist fields based on 2 columns in a lookup, but the second column has multiple values.

So we have to whitelist based on the condition that the username and the destinations are in two fields in the same event.

In the event too, we have the field values(dest) so multiple destinations are in one cell.

The condition is that the user with those destinations should be whitelisted.

How can we achieve this?

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Let me try to illustrate my understanding of the use case. You have a lookup, say whitelist, that contains two fields,

userdestination
user1dest1,dest2,dest3
user2dest1,dest3,dest4,dest5

You haven't described how the multiple values are separated, so I pick comma as separator. You haven't described which field to look up; I assume it is user, which also exist in events with the same field name.

If these assumptions are correct, the SPL to implement your requirement would be something like

| lookup whitelist user ``` assuming match field is user ```
| eval destination = split(destination, ",") ``` assuming comma as separator ```
| eval whitelisted = mvmap(destination, if(dest == destination, "yes", null()))
| where isnotnull(whitelisted)

If, on the other hand, multiple values in lookup is not separated by a character, but is from multilisting, like

userdestination
user1dest1
user2dest1
user1dest2
user2dest3
user1dest3
user2dest5

The output from lookup would have already been multivalued. In this case, you won't need that split, i.e.,

| lookup whitelist user ``` assuming match field is user ```
| eval whitelisted = mvmap(destination, if(dest == destination, "yes", null()))
| where isnotnull(whitelisted)

(The moral of the story: Be specific about inputs.)

Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...