How to search a lookup table to find any IP addresses that match the IPs in my firewall events?

[meadowh]

I have a lookup table called - c2cisp.csv. the definition is called c2cisp.
The table has a field name ip. It contains IP addresses.
I want to search through my firewall logs to check to see any events where the ip in my events field 'd_ip' matches any of the ips in the 'ip' field in my lookup table.
Seems like it should be pretty easy right?

Any help much appreciated

[meadowh]

Great thanks guys.
i had a few errors in my lookup table that caused some weird results.
All good now.

I have used this before as my guide:
search | lookup [lookup definition name] [fieldname1 in lookup table to check] as [fieldname2 in events] OUTPUT [ fieldname3 in lookuptable ] as [fieldname4 - you can create a new name] | search [fieldname4]=”*”

couldn't understand why it wasn't working this time!

[matthieu_araman]

I would do something like
* | lookup c2cisp.csv ip as d_ip OUTPUT ip as c2cisp | search c2cisp=*

[vinitatsky]

sourcetype="" | rename d_ip as ip | lookup c2cisp ip OUTPUTNEW ip | table ip,

1) | rename d_ip as ip -- Just to make sure both fields names are same (lookup field name and actual field name)
2) | lookup c2cisp ip OUTPUTNEW ip -- This command will look for 'ip' value in 'c2cisp' and will output ip field from lookup. If you want to view more fields from lookup then you can add it here.

Hope this helps.

[vganjare]

You can use lookup command. http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Lookup

Refer to examples section.

Thanks!!