Splunk Search

Lookup returns all events

ankit
Explorer

Hi 
I'm a beginner at Splunk and am running into a problem with lookups. I have indexed IIS data in one sourcetype called 'iis' and uploaded a lookup csv called 'cve-ip'  which is defined already.

Trying to corelate and find matches for the 'src_ip' column in the 'cve-ip' file with the 'c-ip' field in the 'iis' source type. Here is the SPL lookup I am running : 

sourcetype=iis
| lookup cve-ip src_ip AS c_ip 

This SPL is returning all events in the 'iis' sourcetype and not only those which match the values in the 'src_ip' column in the 'cve-ip' file. I would like some help figuring out why this is happening and returning all events as opposed to just matching events. Happy to provide any details as needed

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @ankit,

to filter events usimng a lookup you have to use the inputlookup command (https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Inputlookup), something like this:

sourcetype=iis [ | inputlookup cve-ip | rename src_ip AS c_ip | fields c_ip ]
| ....

Put attention that the field used for the filter must have the same name of the corrispondent in the main search.

You could also use the lookup command and it's useful if you need to use some additinal fields from the lookup, something like this:

sourcetype=iis
| lookup cve-ip src_ip AS c_ip OUTPUT another_field
| where another_field=*
| ....

But the first is prefereable because it's better to filter events as left as possible.

Only one additional hint: use always the index in your searches. they will be more performant!

Ciao.

Giuseppe

View solution in original post

ankit
Explorer

Thanks @gcusello . I was a little confused between the usage of lookup and inputlookup. Your answer and this post here cleared it up. 

Also appreciate you pointing out the tip about using the 'index' field. 

Thank you ! 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ankit,

to filter events usimng a lookup you have to use the inputlookup command (https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Inputlookup), something like this:

sourcetype=iis [ | inputlookup cve-ip | rename src_ip AS c_ip | fields c_ip ]
| ....

Put attention that the field used for the filter must have the same name of the corrispondent in the main search.

You could also use the lookup command and it's useful if you need to use some additinal fields from the lookup, something like this:

sourcetype=iis
| lookup cve-ip src_ip AS c_ip OUTPUT another_field
| where another_field=*
| ....

But the first is prefereable because it's better to filter events as left as possible.

Only one additional hint: use always the index in your searches. they will be more performant!

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...