Splunk Search

Splunk query filtering on lookup table csv

vfm
New Member

Hello,

I have a query which shows me whether malicious sites have been accessed per client ip:

"Potentially Unwanted Software" OR "Gambling" OR "Suspicious" OR "Scam/Questionable/Illegal" OR "Proxy Avoidance" | stats count by src_ip | sort count desc

I also to have those categories in a lookup table:

Potentially Unwanted Software
Gambling
Suspicious
Scam/Questionable/Illegal
Proxy Avoidance"

I would like to have a query like this:

lookup malicious_sites.csv | search * | stats count by src_ip | sort count desc

Somehow it is not working, can you guys help me out what I'm doing wrong?

V

Tags (2)
0 Karma

Akili
Path Finder

me too, no results found

0 Karma

vfm
New Member

Hello Ayn,

thanks for you response.
I tried your query, because it looked exactly like what I wanted. And yes, in both my lookup and the events the field is category
However it returns no results, whereas when I put the categories in my query, I do get results.

This happens also when I try examples I find in the documentation. Somehow there is still something incorrect.

Regards,
V

0 Karma

Ayn
Legend

lookup doesn't work like that. You should read the docs on the lookup command and the inputlookup command.

What you want is probably something like this (assuming your field for this is called "category" in both the lookup and your events):

[inputlookup malicious_sites.csv | fields category] | stats count by src_ip | sort - count
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...