Splunk Search

How to search for IP addresses in a lookup that are not found in my events?

adamsmith47
Communicator

I have a lookup which has an IP address column, and I'm trying to find which if the IP addresses from this lookup table DO NOT appear in any of my events.

I've very new to this. I've been trying several things, with no success yet.

Thanks for any replies.

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this (assuming ip_address is the field that appears in your events and ip_field is the field in lookup table)

index=foo sourcetype=bar [| inputlookup your_ip_lookup.csv | table ip_field | rename ip_field as ip_address] | stats count by ip_address | append [| inputlookup your_ip_lookup.csv | table ip_field | rename ip_field as ip_address | eval count=0 ] | stats max(count) as count by ip_address | where count=0

View solution in original post

0 Karma

somesoni2
Revered Legend

Try something like this (assuming ip_address is the field that appears in your events and ip_field is the field in lookup table)

index=foo sourcetype=bar [| inputlookup your_ip_lookup.csv | table ip_field | rename ip_field as ip_address] | stats count by ip_address | append [| inputlookup your_ip_lookup.csv | table ip_field | rename ip_field as ip_address | eval count=0 ] | stats max(count) as count by ip_address | where count=0
0 Karma

adamsmith47
Communicator

Perfect. Thank you!

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...