Splunk Search

How to search a lookup table to find any IP addresses that match the IPs in my firewall events?


I have a lookup table called - c2cisp.csv. the definition is called c2cisp.
The table has a field name ip. It contains IP addresses.
I want to search through my firewall logs to check to see any events where the ip in my events field 'd_ip' matches any of the ips in the 'ip' field in my lookup table.
Seems like it should be pretty easy right?

Any help much appreciated

Tags (4)
0 Karma


Great thanks guys.
i had a few errors in my lookup table that caused some weird results.
All good now.

I have used this before as my guide:
search | lookup [lookup definition name] [fieldname1 in lookup table to check] as [fieldname2 in events] OUTPUT [ fieldname3 in lookuptable ] as [fieldname4 - you can create a new name] | search [fieldname4]=”*”

couldn't understand why it wasn't working this time!


I would do something like
* | lookup c2cisp.csv ip as d_ip OUTPUT ip as c2cisp | search c2cisp=*

0 Karma


sourcetype="" | rename d_ip as ip | lookup c2cisp ip OUTPUTNEW ip | table ip,

1) | rename d_ip as ip -- Just to make sure both fields names are same (lookup field name and actual field name)
2) | lookup c2cisp ip OUTPUTNEW ip -- This command will look for 'ip' value in 'c2cisp' and will output ip field from lookup. If you want to view more fields from lookup then you can add it here.

Hope this helps.


You can use lookup command. http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Lookup

Refer to examples section.


0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...