Splunk Search

How do I get a Splunk conditional lookup command to match only specific values?

New Member


My search is based on 3 sources (firewall log, ioc feed macro and lookup table for ioc). To check for any match on ioc for the destip field.

| search [<macro>
| table destip
| format]
| lookup <lookup table> srcip as destip OUTPUT columnA as A
| lookup <lookup table> srcip as destip OUTPUT columnB as B
| table _time, destip, A, B

However, 1 ioc can have multiple row of data in the for column B:


Hence, the result of the above SPL will give me:

<time>-<output A>-high low

How do i include a condition to only lookup and match the ioc for only "high" events in column B in the lookup table, to be as below ouput?

<time>-<output A>-high
Tags (4)
0 Karma


I'll be the first to say this.. Your query is going to be painfully slow and will not scale, especially with firewall logs.

Instead, you should lump all 3 sources together like this

(index=firewall sourcetype=...) OR (index=...) 
| stats count by srcip
| lookup 

Also, rather than using table, you should use a stats before the lookup for better performance

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...