Splunk Search

How to use a lookup file to search for ip addresses in my logs?

jcaron9999a
Explorer

I have a lookup file called ipaddress.csv.  The column title in the file is ipaddress.  I want to search my logs for all of these ip addresses.  I know I need to use inputlookup to get the addresses from the file, but I can't figure out how to then feed them to a search.

 

Thanks in advance

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

This is a subsearch, where the inputlookup is used as a subsearch

your_base_search [ | inputlookup ipaddress.csv | fields ipaddress ]

Here the subsearch ([] section) runs first and returns a structured piece of text with 

ipaddress=A OR ipaddress=B OR ipaddress=C

and so on to the outer search. Note that if your ip address field in your main index search is something different, then before the fields command, you should do a rename

| rename ipaddress as your_ip_field

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

This is a subsearch, where the inputlookup is used as a subsearch

your_base_search [ | inputlookup ipaddress.csv | fields ipaddress ]

Here the subsearch ([] section) runs first and returns a structured piece of text with 

ipaddress=A OR ipaddress=B OR ipaddress=C

and so on to the outer search. Note that if your ip address field in your main index search is something different, then before the fields command, you should do a rename

| rename ipaddress as your_ip_field

 

jcaron9999a
Explorer

Thanks!  That did the trick.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...