Splunk Search

IP Watchlist Lookup

nlisle
New Member

Hello,

I currently have a search against our firewalls, below is the current search.

index=(my index) sourcetype="my_source" ipsrcip!=(ip)

I have a lookup file called 'threatip' that contains a list of source IP's in the first column named 'ip'. I would like to create a search that presents events from the initial search where the source IP from the lookup matches the source IP in the firewall logs.

Firewall log fields -

Source IP - 'srcip'

Lookup Table Fields -

Source IP - 'ip'

It seems so simple yet I am having some issues with it, advice would be much appreciated.

Thank you,
Nick.

0 Karma

jbillings
SplunkTrust
SplunkTrust

Try this
index=(my index) sourcetype="my_source" |search [|inputlookup threatip.csv | fields ip |rename ip as srcip]

0 Karma

woodcock
Esteemed Legend

Like this:

index="myIndex" AND sourcetype="my_source" AND ipsrcip!=(ip) AND [|inputlookup MyLookupFile.csv | rename ip as srcip | table srcip]

OR

index="myIndex" AND sourcetype="my_source" AND ipsrcip!=(ip)
| lookup MyLookupFile.csv ip AS srcip OUTPUT ip AS MATCHED
| where isnotnull(MATCHED)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi nlisle,
please try something like this:

index=my index sourcetype="my_source" [ | inputlookup threatip | rename ip AS srcip | fields srcip ]
| ...

Ciao.
Giuseppe

0 Karma

nlisle
New Member

Hi Giuseppe, I have tried this search however I receive no results. I can confirm that I have already added some data into the lookup, IP's that have hit the firewall in the past 30 days. I am also running my search over the last 30 days. Thanks.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...