Splunk Search

How to use a lookup table field to discard events?

New Member

We have a list of Ips in a lookup table and we want to search events that doesn't match with them.

The lookup definition "scanners_lookup" has a field called "Ip_Scanner" and the events in the index we are looking for has another called "source_ip". How do we build the search? We have tried several approachs that don't work.

For instance:

index=my_index | lookup scanners_lookup  Ip_Scanner | where source_ip != IP_scanner

Thank you!

Labels (1)
0 Karma

Revered Legend

Try like this

index=yourindex sourcetype=yourSourcetype [| inputlookup scanners_lookup | table Ip_Scanner | rename Ip_Scanner as source_ip ]
0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...