What I am trying to do is look through srcip and destip to see if they match the list of IP Addresses that are on a lookup table (these IP are known to be bad IP Addresses). The only problem with doing this is that I can only look at one field at a time because lookup act as a LOGIC AND when comparing fields. One solution I to append a subsearch that either looks up the other destip while the main search looks up the srcip or vice versa. Only problem is that the subsearch does not work the way I intended. Is there a better approach to do this. Any help is greatly appreciated.
Here are couple of options for your requirement that can be tried
Lookup values as giant OR condition (assuming your lookup file has one field called 'IP') - good if no of IP in your lookup is less
your base search giving field srcip and destip | search [| inputlookup yourIpLookup.csv | eval srcip=IP | eval destip=IP | table srcip destip | format "(" "(" "OR" "" ") OR" ")" ]
Regular Lookup command (assuming your lookup file has two field IP and flag, add flag field with all values as '1')
your base search giving field srcip and destip | lookup yourIpLookup.csv IP as srcip OUTPUT flag as SrcIPFound | lookup yourIpLookup.csv IP as destip OUTPUT flag as DestIPFound
Use the flags SrcIPFound and DestIPFound to see if the srcip and/or destip was found in lookup.