How to have a search look for a match between one field's values and different lookup table field?

[tminicoz]

My objective is to make a search that compares the dest_ip field value of outbound traffic with the ip values in a lookup table of malicious IPs that results with any matches.

The current search is something simple like:

index=NetworkTraffic dest_zone="Internet" NOT src_zone="Internet"

to view the outbound traffic. The output includes a dest_ip field. 

If I have a lookup table called maliciousIPs.csv, which contains a field called "ip", how do I compare that to the dest_ip field? 

Ex: If the dest_ip field value of one of the NetworkTraffic logs is 1.2.3.4 and the IP address 1.2.3.4 exists within maliciousIPs.csv, then the search would result. 

[bowesmana · Accepted solution]

Use the lookup command

https://docs.splunk.com/Documentation/Splunk/9.0.2/SearchReference/Lookup

This will lookup your data field 'dest_ip' against the ip field in the lookup and set a new field 'found_ip' if a match is found.

The where clause then filters out only those where matches were found

| lookup maliciousIPs.csv ip as dest_ip OUTPUT ip as found_ip
| where isnotnull(found_ip)

[tminicoz]

Thank you bowesmana for the reply! I did a bit of testing, and this is working as intended. Thank you!