Splunk Search

Match IP from main search to an IP in lookup file and output only the events that match from the main search

carldipace
New Member

I have my main search below. I want to match ip's from my main search to the ip's in my lookup file and output only the events that match. The lookup file field for my ip's is "host_ip" and the field in my main search is "dest_ip".

index=fda_sec_suricata sourcetype=suricata (src_ip!=10.X.X.X/X AND src_ip!=172.X.X.X/X AND src_ip!=192.X.X.X/X) (host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X") |
eval CVE_listed=if(isnotnull(reference_cve) OR like(signature,"%CVE"),1,0) | rex field=signature "CVE-(?\d+-\d+)" |
eval reference_cve="CVE-".reference_cve |
search (CVE_listed=1) |
dedup reference_cve, src_ip, src_port, dest_ip, dest_port |
table category, signature, severity, reference_cve, reference_url, src_ip, src_port, dest_dns, dest_nt_host, dest_ip, dest_port, _time

0 Karma

somesoni2
Revered Legend

Try this

index=fda_sec_suricata sourcetype=suricata (src_ip!=10.X.X.X/X AND src_ip!=172.X.X.X/X AND src_ip!=192.X.X.X/X) (host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X")  [| inputlookup YourLookup.csv | table host_ip | rename host_ip as dest_ip ]
| eval CVE_listed=if(isnotnull(reference_cve) OR like(signature,"%CVE"),1,0) | rex field=signature "CVE-(?\d+-\d+)" 
| eval reference_cve="CVE-".reference_cve 
| search (CVE_listed=1) 
| dedup reference_cve, src_ip, src_port, dest_ip, dest_port 
| table category, signature, severity, reference_cve, reference_url, src_ip, src_port, dest_dns, dest_nt_host, dest_ip, dest_port, _time
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!