Splunk Search

How to compare IP and Username in Logs with Lookup File

New Member


I am trying to compare IP,user field in a log and then compare it with a lookup file(having only IP and username field). What I want to try is to find the firewall logs having same IP with the lookup file but different username. Could you help me? Let's assume the fields as below.

Username in log: assigned_user
IP in the log: assigned_ip
username in lookup file: username

IP in the lookup file: src_ip

0 Karma

Esteemed Legend

Hi gozdeyildiz,
try something like this:

index=my_index assigned_user=*
| lookup my_lookup.csv src_ip AS assigned_ip OUTPUT username
| search  NOT assigned_user=username
| dedup assigned_ip assigned_user
| table assigned_ip assigned_user username


0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...