What I am trying to do is look through src_ip and dest_ip to see if they match the list of IP Addresses that are on a lookup table (these IP are known to be bad IP Addresses). The only problem with doing this is that I can only look at one field at a time because lookup act as a LOGIC AND when comparing fields. One solution I to append a subsearch that either looks up the other dest_ip while the main search looks up the src_ip or vice versa. Only problem is that the subsearch does not work the way I intended. Is there a better approach to do this. Any help is greatly appreciated.
Here are couple of options for your requirement that can be tried
Lookup values as giant OR condition (assuming your lookup file has one field called 'IP') - good if no of IP in your lookup is less
your base search giving field src_ip and dest_ip | search [| inputlookup yourIpLookup.csv | eval src_ip=IP | eval dest_ip=IP | table src_ip dest_ip | format "(" "(" "OR" "" ") OR" ")" ]
Regular Lookup command (assuming your lookup file has two field IP and flag, add flag field with all values as '1')
your base search giving field src_ip and dest_ip | lookup yourIpLookup.csv IP as src_ip OUTPUT flag as SrcIPFound | lookup yourIpLookup.csv IP as dest_ip OUTPUT flag as DestIPFound
Use the flags SrcIPFound and DestIPFound to see if the src_ip and/or dest_ip was found in lookup.
You can modify the logic with the format
command.
Sorry for being an idiot and not proof reading. What I meant is if there is a way for me to have the lookup command act as logic OR.