How to use make a Logic OR for lookup?

[syx093]

What I am trying to do is look through src_ip and dest_ip to see if they match the list of IP Addresses that are on a lookup table (these IP are known to be bad IP Addresses). The only problem with doing this is that I can only look at one field at a time because lookup act as a LOGIC AND when comparing fields. One solution I to append a subsearch that either looks up the other dest_ip while the main search looks up the src_ip or vice versa. Only problem is that the subsearch does not work the way I intended. Is there a better approach to do this. Any help is greatly appreciated.

[somesoni2]

Here are couple of options for your requirement that can be tried

1. Lookup values as giant OR condition (assuming your lookup file has one field called 'IP') - good if no of IP in your lookup is less

   your base search giving field src_ip and dest_ip | search [| inputlookup yourIpLookup.csv | eval src_ip=IP | eval dest_ip=IP | table src_ip dest_ip | format "(" "(" "OR" "" ") OR" ")" ]

2. Regular Lookup command (assuming your lookup file has two field IP and flag, add flag field with all values as '1')

   your base search giving field src_ip and dest_ip | lookup yourIpLookup.csv IP as src_ip OUTPUT flag as SrcIPFound | lookup yourIpLookup.csv IP as dest_ip OUTPUT flag as DestIPFound

Use the flags SrcIPFound and DestIPFound to see if the src_ip and/or dest_ip was found in lookup.

[woodcock]

You can modify the logic with the format command.

[syx093]

Sorry for being an idiot and not proof reading. What I meant is if there is a way for me to have the lookup command act as logic OR.