Splunk Search

How to use make a Logic OR for lookup?

Communicator

What I am trying to do is look through srcip and destip to see if they match the list of IP Addresses that are on a lookup table (these IP are known to be bad IP Addresses). The only problem with doing this is that I can only look at one field at a time because lookup act as a LOGIC AND when comparing fields. One solution I to append a subsearch that either looks up the other destip while the main search looks up the srcip or vice versa. Only problem is that the subsearch does not work the way I intended. Is there a better approach to do this. Any help is greatly appreciated.

0 Karma

SplunkTrust
SplunkTrust

Here are couple of options for your requirement that can be tried

  1. Lookup values as giant OR condition (assuming your lookup file has one field called 'IP') - good if no of IP in your lookup is less

    your base search giving field srcip and destip | search [| inputlookup yourIpLookup.csv | eval srcip=IP | eval destip=IP | table srcip destip | format "(" "(" "OR" "" ") OR" ")" ]

  2. Regular Lookup command (assuming your lookup file has two field IP and flag, add flag field with all values as '1')

    your base search giving field srcip and destip | lookup yourIpLookup.csv IP as srcip OUTPUT flag as SrcIPFound | lookup yourIpLookup.csv IP as destip OUTPUT flag as DestIPFound

Use the flags SrcIPFound and DestIPFound to see if the srcip and/or destip was found in lookup.

Esteemed Legend

You can modify the logic with the format command.

0 Karma

Communicator

Sorry for being an idiot and not proof reading. What I meant is if there is a way for me to have the lookup command act as logic OR.

0 Karma