Lookup table not giving results.

[neonmonarch]

Hi all,

I've trying to establish a lookup table that is used in a query (query below). I've setup the lookup table in Defintions & Files. When I run the query, I get matching events but with 0 results.

I have the index, time range and status details. Have removed company specific information.

| eval srcip=dstip
| lookup lt1 cidr_value AS srcip OUTPUT network AS srcnet, cidr_value AS srccidr 

| replace internal_private WITH "Internal private" IN srcnet
| replace internal_public WITH "Internal public" IN srcnet
| replace Unknown WITH "Uknown" IN srcnet

| eval srccidr=if(srccidr="Unknown", srcip, srccidr)

| stats c(id) AS "# incidents", values(srcnet) AS "netid" by srccidr
| eval net=replace(srccidr, "\/+", "")
| geoip net 
| table srccidr netid net_country_name "# incidents"
| rename srccidr AS "Network", netid AS "Classification", net_country_name AS "Origin"
| sort 15 - "# incidents"
| fillnull value="-"

If anyone has some ideas on how to produce results.

Thanks

[ShaneNewman · Accepted solution]

If you run the search all the way to your stats command, then table id, srcnet and srccidr; do you get results for all of the fields? If there are no values for srccidr, there cannot be any stats done on it...

[ShaneNewman]

Glad I could help!

[neonmonarch]

You deserve a cookie! Thank you very much.