Lookup returns all events

[ankit]

Hi 
I'm a beginner at Splunk and am running into a problem with lookups. I have indexed IIS data in one sourcetype called 'iis' and uploaded a lookup csv called 'cve-ip'  which is defined already.

Trying to corelate and find matches for the 'src_ip' column in the 'cve-ip' file with the 'c-ip' field in the 'iis' source type. Here is the SPL lookup I am running : 

sourcetype=iis
| lookup cve-ip src_ip AS c_ip 

This SPL is returning all events in the 'iis' sourcetype and not only those which match the values in the 'src_ip' column in the 'cve-ip' file. I would like some help figuring out why this is happening and returning all events as opposed to just matching events. Happy to provide any details as needed

[ankit]

Thanks @gcusello . I was a little confused between the usage of lookup and inputlookup. Your answer and this post here cleared it up. 

Also appreciate you pointing out the tip about using the 'index' field. 

Thank you ! 

[gcusello · Accepted solution]

Hi @ankit,

to filter events usimng a lookup you have to use the inputlookup command (https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Inputlookup), something like this:

sourcetype=iis [ | inputlookup cve-ip | rename src_ip AS c_ip | fields c_ip ]
| ....

Put attention that the field used for the filter must have the same name of the corrispondent in the main search.

You could also use the lookup command and it's useful if you need to use some additinal fields from the lookup, something like this:

sourcetype=iis
| lookup cve-ip src_ip AS c_ip OUTPUT another_field
| where another_field=*
| ....

But the first is prefereable because it's better to filter events as left as possible.

Only one additional hint: use always the index in your searches. they will be more performant!

Ciao.

Giuseppe