Splunk Search

Comparing field value results to values(alphanumeric) in lookup file


I am trying to compare the field values of a lookup file(alphanumeric values) to the my search results. Please help me with the search command. This is to compare file extensions with that of the blacklisted extensions and to create an alert when it matches.

Lookup :

Extensions Name
.xml XML
.py Python
.sh Shell

Comparing the extensions filed with the results that i get is what i need to do.

0 Karma


Try this:

Match what’s in the lookup:

 index=test [|inputlookup lookupname.csv | fields fieldFromLookup | format ]

Will turn into this:

index=test ((fieldFromLookup=valueFromRow1) OR (fieldFromLookup=valueFromRow2) ...)

If the field name in the lookup is different from the fiel name in your index, add a rename to the subseaech:

index=test [|inputlookup lookupname.csv | fields fieldFromLookup | rename fieldFromLookup as fieldInData | format ]

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!