I have a lookup table consisting of both CIDR addresses and regular x.x.x.x addresses under the field named "IP_Address". The lookup definition has Match type: <CIDR>(<IP_Address>)
I need to create a search against data model that only shows events where the src in the events matches the IP_Address field in the lookup table. I will also add additional fields from the events to the search results: _time, action, IP_Address/src, dest, dest_port. I would also like to add an additional field from the lookup table called "Date Blocked".
I have this so far for the first part, but it is not returning any results. Any suggestions? Thank you in advance 🙂
from datamodel:"Network" |where [inputlookup Blocked_IPs | rename src as IP_Address | fields IP_Address ]| table _time, action, IP_Address, dest, dest_port
