Splunk Search

How to have a search look for a match between one field's values and different lookup table field?

tminicoz
Engager

My objective is to make a search that compares the dest_ip field value of outbound traffic with the ip values in a lookup table of malicious IPs that results with any matches.

The current search is something simple like:

index=NetworkTraffic dest_zone="Internet" NOT src_zone="Internet"

to view the outbound traffic. The output includes a dest_ip field. 

If I have a lookup table called maliciousIPs.csv, which contains a field called "ip", how do I compare that to the dest_ip field? 

Ex: If the dest_ip field value of one of the NetworkTraffic logs is 1.2.3.4 and the IP address 1.2.3.4 exists within maliciousIPs.csv, then the search would result. 

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Use the lookup command

https://docs.splunk.com/Documentation/Splunk/9.0.2/SearchReference/Lookup

This will lookup your data field 'dest_ip' against the ip field in the lookup and set a new field 'found_ip' if a match is found.

The where clause then filters out only those where matches were found

| lookup maliciousIPs.csv ip as dest_ip OUTPUT ip as found_ip
| where isnotnull(found_ip)

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use the lookup command

https://docs.splunk.com/Documentation/Splunk/9.0.2/SearchReference/Lookup

This will lookup your data field 'dest_ip' against the ip field in the lookup and set a new field 'found_ip' if a match is found.

The where clause then filters out only those where matches were found

| lookup maliciousIPs.csv ip as dest_ip OUTPUT ip as found_ip
| where isnotnull(found_ip)

 

0 Karma

tminicoz
Engager

Thank you bowesmana for the reply! I did a bit of testing, and this is working as intended. Thank you!

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...