Splunk Search

How to modify my search to data model search by adding a lookup table?

Path Finder


My task involves creating a search in datamodel i.e network_traffic, below is the base search how we could convert it to data model search 

| tstats summariesonly=t
values(All_Traffic.src_ip) as src_ip,
dc(All_Traffic.dest_port) as num_dest_port,
values(All_Traffic.dest_port) as dest_port
from datamodel=Network_Traffic by All_Traffic.dest_ip
| where num_dest_port > 100

 | search NOT [| inputlookup  addresses.csv | search (comments =*scanner*) | fields IP AS ALL_Traffic.src_ip | format ]

colored in red is not working as expected !!



Labels (1)
Tags (1)
0 Karma

Esteemed Legend

| tstats ,values(All_Traffic.dest_port) AS dest_port values(All_Traffic.dest_ip) AS dest_ip dc(All_Traffic.dest_ip) AS num_dest_ip dc(All_Traffic.dest_port) AS num_dest_port
FROM datamodel=Network_Traffic
WHERE index="firewall" AND sourcetype="traffic" AND NOT [| inputlookup addresses.csv | search (comments =*scanner*) | table IP | rename IP AS ALL_Traffic.src_ip | format ]
BY All_Traffic.src_ip
| rename All_Traffic.* AS *
| where num_dest_port > 100

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...