Splunk Search

How to search a lookup table to find any IP addresses that match the IPs in my firewall events?


I have a lookup table called - c2cisp.csv. the definition is called c2cisp.
The table has a field name ip. It contains IP addresses.
I want to search through my firewall logs to check to see any events where the ip in my events field 'd_ip' matches any of the ips in the 'ip' field in my lookup table.
Seems like it should be pretty easy right?

Any help much appreciated

Tags (4)
0 Karma


Great thanks guys.
i had a few errors in my lookup table that caused some weird results.
All good now.

I have used this before as my guide:
search | lookup [lookup definition name] [fieldname1 in lookup table to check] as [fieldname2 in events] OUTPUT [ fieldname3 in lookuptable ] as [fieldname4 - you can create a new name] | search [fieldname4]=”*”

couldn't understand why it wasn't working this time!


I would do something like
* | lookup c2cisp.csv ip as d_ip OUTPUT ip as c2cisp | search c2cisp=*

0 Karma


sourcetype="" | rename d_ip as ip | lookup c2cisp ip OUTPUTNEW ip | table ip,

1) | rename d_ip as ip -- Just to make sure both fields names are same (lookup field name and actual field name)
2) | lookup c2cisp ip OUTPUTNEW ip -- This command will look for 'ip' value in 'c2cisp' and will output ip field from lookup. If you want to view more fields from lookup then you can add it here.

Hope this helps.


You can use lookup command. http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Lookup

Refer to examples section.


0 Karma
Get Updates on the Splunk Community!

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...