Filtering events using a lookup table

[waJesu]

How do I use a lookup table to filter events based on a list of known malicious IP addresses (in CIDR format), or to exclude events from known internal IP ranges.

[yuanliu]

Have you looked up Create a CSV lookup definition?  You can define a field as match type CIDR.  The question is extremely vague.  If you want concrete help, illustrate mock data, desired results, and explain the logic between data and desired results.

[fredclown]

You could do something like this. Imagine a lookup that looks like this.

ip_lookup.csv

ip

10.10.53.22

127.0.0.1

192.168.0.54

index=myindex ([| inputlookup ip_lookup.csv | stats values(eval("ip=\""+src_ip+"\"")) as search | eval search=mvjoin(search, " OR ")])

This produces ...

index=myindex (src_ip="10.10.53.22" OR src_ip="127.0.0.1" OR src_ip="192.168.0.54")

... or ...

index=myindex ([| inputlookup ip_lookup.csv | stats values(eval("src_ip!=\""+ip+"\"")) as search | eval search=mvjoin(search, " AND ")])

This produces ...

index=myindex (src_ip!="10.10.53.22" AND src_ip!="127.0.0.1" AND src_ip!="192.168.0.54")

You could even just put the sub-search into a macro that references the lookup to make using it easier for reuse. An example would be like this.

Macro name:
my_ip_macro

Macro definition:

[| inputlookup ip_lookup.csv
| stats values(eval("src_ip=\""+ip+"\"")) as search
| eval search=mvjoin(search, " OR ")]

Search using the macro:

index=myindex `my_ip_macro`

[_JP]

Here are a couple posts that cover this concept:

Solved: Search for items not matching values from a lookup - Splunk Community

Solved: Compare search results with a lookup table and ide... - Splunk Community