Splunk Search

Design a search for find list intersection of kvstore and inndex and put them to summary index

Daniel_Pham
Explorer

I'm new to Splunk And I'm trying to build summary index 

i have KVStore and index

A: inputlookup spam_ip (which is Indicator of compromise)

B: index=main (which is event log)

Both indexes have a field that has the same data:

eg: A has a field (spam_ip), B has a field (source_ip)

And populate all record in set A that the record have data field contain in set B into summary index

 

Labels (1)
Tags (1)
0 Karma
1 Solution

Daniel_Pham
Explorer

i got it with this 

| inputlookup spam_ip | join srcip [ search index=main | rename ip  as srcip | fields srcip ]

thank you for your time

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

it would help to know what you've tried so far and what the results were, but perhaps this will help:

index=main [ | inputlookup spam_ip | rename spam_ip as source_ip | fields source_ip | format ]
---
If this reply helps you, Karma would be appreciated.

Daniel_Pham
Explorer

it works but when i tried this

| inputlookup ts_lookup_destip (index=main | rename ip as srcip | fields srcip | format)

i get an error

The result i want is which indicator of compromise (include all fields) is used to detect 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What error do you get?  It must be syntax related since that query is not valid SPL.  Replacing the square brackets with parentheses completely changes the query.  Did you try the same query with square brackets?

---
If this reply helps you, Karma would be appreciated.

Daniel_Pham
Explorer

i got it with this 

| inputlookup spam_ip | join srcip [ search index=main | rename ip  as srcip | fields srcip ]

thank you for your time

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.

Daniel_Pham
Explorer

when i tried this

| inputlookup ts_lookup_destip [index=main | rename ip as srcip | fields srcip | format]

i get Unknown search command 'index'.

0 Karma

Daniel_Pham
Explorer

it works, thank you !!

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...