Splunk Search

How to match on value NOT in lookup table

DEADBEEF
Path Finder

I have a list of IP addresses in a lookup table that are network scanners.

I am trying to build a search that excludes the IP addresses in this lookup table, but for some reason my search keeps including IP address values that are clearly present in the lookup.  I tried putting the quotes around the IP addresses ("1.2.3.4"), tried without quotes (1.2.3.4) but nothing works.  The raw data does not have quotes.  After having tried enough  combinations, I am hoping someone can help me.  Eventually, I'll be adding the remaining IP's to the lookup table via OUTPUTLOOKUP append=true but until I can get this working... I'm stuck.

 

index=foo sourcetype=bar NOT 
    [| inputlookup network_scanners
    | table IpAddress] 
| dedup IpAddress 
| table IpAddress

 

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Have you tried format?

index=foo sourcetype=bar NOT 
    [| inputlookup network_scanners
    | table IpAddress
    | format] 
| dedup IpAddress 
| table IpAddress

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Have you tried format?

index=foo sourcetype=bar NOT 
    [| inputlookup network_scanners
    | table IpAddress
    | format] 
| dedup IpAddress 
| table IpAddress
0 Karma

DEADBEEF
Path Finder

That was the fix!  What about the format command resolved this?

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It formats the events returned by the inputlookup into a string like 

((IpAddress="1.1.1.1") OR (IpAddress="2.2.2.2"))

so it can be used as part of the (initial) search

DEADBEEF
Path Finder

Ahh okay.  Is this because the IP address has minor breakers so if you don't use format then it doesn't work as expected?  Just curious as I never had to use it before (but was never matching against IP's).

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Essentially, yes. As I understand it, splunk will sometimes break things up by punctuation so 1.1.1.1 it treated as up to 4 separate strings.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...