I have a list of IP addresses in a lookup table that are network scanners.
I am trying to build a search that excludes the IP addresses in this lookup table, but for some reason my search keeps including IP address values that are clearly present in the lookup. I tried putting the quotes around the IP addresses ("22.214.171.124"), tried without quotes (126.96.36.199) but nothing works. The raw data does not have quotes. After having tried enough combinations, I am hoping someone can help me. Eventually, I'll be adding the remaining IP's to the lookup table via OUTPUTLOOKUP append=true but until I can get this working... I'm stuck.
index=foo sourcetype=bar NOT [| inputlookup network_scanners | table IpAddress] | dedup IpAddress | table IpAddress
It formats the events returned by the inputlookup into a string like
((IpAddress="188.8.131.52") OR (IpAddress="184.108.40.206"))
so it can be used as part of the (initial) search
Ahh okay. Is this because the IP address has minor breakers so if you don't use format then it doesn't work as expected? Just curious as I never had to use it before (but was never matching against IP's).