Splunk Search

How to match on value NOT in lookup table

DEADBEEF
Path Finder

I have a list of IP addresses in a lookup table that are network scanners.

I am trying to build a search that excludes the IP addresses in this lookup table, but for some reason my search keeps including IP address values that are clearly present in the lookup.  I tried putting the quotes around the IP addresses ("1.2.3.4"), tried without quotes (1.2.3.4) but nothing works.  The raw data does not have quotes.  After having tried enough  combinations, I am hoping someone can help me.  Eventually, I'll be adding the remaining IP's to the lookup table via OUTPUTLOOKUP append=true but until I can get this working... I'm stuck.

 

index=foo sourcetype=bar NOT 
    [| inputlookup network_scanners
    | table IpAddress] 
| dedup IpAddress 
| table IpAddress

 

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Have you tried format?

index=foo sourcetype=bar NOT 
    [| inputlookup network_scanners
    | table IpAddress
    | format] 
| dedup IpAddress 
| table IpAddress

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Have you tried format?

index=foo sourcetype=bar NOT 
    [| inputlookup network_scanners
    | table IpAddress
    | format] 
| dedup IpAddress 
| table IpAddress
0 Karma

DEADBEEF
Path Finder

That was the fix!  What about the format command resolved this?

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It formats the events returned by the inputlookup into a string like 

((IpAddress="1.1.1.1") OR (IpAddress="2.2.2.2"))

so it can be used as part of the (initial) search

DEADBEEF
Path Finder

Ahh okay.  Is this because the IP address has minor breakers so if you don't use format then it doesn't work as expected?  Just curious as I never had to use it before (but was never matching against IP's).

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Essentially, yes. As I understand it, splunk will sometimes break things up by punctuation so 1.1.1.1 it treated as up to 4 separate strings.

Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...