Splunk Search

Compare values from log and lookup

ialahdal
Path Finder

I have a lookup table that contains the data similar to the:
Service_name, IP, Port
HTTPS, 10.10.10.10, 443
DNS, 10.10.10.11, 80

What I am trying to achieve is to make a search that'll compare existing IPs and ports from the logs that are in fields destip, destport and return values that match both, i.e. if "destip = IP & destport = Port then return service_name but I don't know how to achieve this in SPL.

I can match destip with the IP from the lookup and return a new field for service_name based on that but that doesn't help me achieve what I need

| lookup service_lookup IP AS destip OUTPUTNEW service_name

Thank you.

0 Karma
1 Solution

to4kawa
Ultra Champion
| makeresults
| eval ip="10.10.10.9,10.10.10.10,10.10.10.11,10.10.10.12,10.10.10.13"
| eval port="8,8,8,8,8"
| makemv delim="," ip
| makemv delim="," port
| eval tmp=mvzip(ip,port)
| mvexpand tmp
| rex field=tmp "(?<IP>[^,]+),(?<Port>[^,]+)"
| fields IP,Port
| join IP Port
 [| stats count
| eval _raw="service_name, IP, Port
HTTPS,10.10.10.10,443
DNS,10.10.10.11,8"
| multikv forceheader=1
| fields - _*
| fields service_name IP Port]

Hi, this is sample query.

your search query
| join destip destport [| inputlookup service_lookup
| rename IP as destip
| rename Port as destport]

How about this?

View solution in original post

0 Karma

to4kawa
Ultra Champion
| makeresults
| eval ip="10.10.10.9,10.10.10.10,10.10.10.11,10.10.10.12,10.10.10.13"
| eval port="8,8,8,8,8"
| makemv delim="," ip
| makemv delim="," port
| eval tmp=mvzip(ip,port)
| mvexpand tmp
| rex field=tmp "(?<IP>[^,]+),(?<Port>[^,]+)"
| fields IP,Port
| join IP Port
 [| stats count
| eval _raw="service_name, IP, Port
HTTPS,10.10.10.10,443
DNS,10.10.10.11,8"
| multikv forceheader=1
| fields - _*
| fields service_name IP Port]

Hi, this is sample query.

your search query
| join destip destport [| inputlookup service_lookup
| rename IP as destip
| rename Port as destport]

How about this?

0 Karma

ialahdal
Path Finder

I was able to get what I wanted off of what you had here, eventually even decreased the search query to | lookup service_lookup IP as destip Port as destport OUTPUTNEW service_name
Which matched the port & ip from the logs to the table and then created a new field named "service_name" based on the results.

0 Karma

to4kawa
Ultra Champion

So that's it.
It will be helpful. Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...