Splunk query filtering on lookup table csv

[vfm]

Hello,

I have a query which shows me whether malicious sites have been accessed per client ip:

"Potentially Unwanted Software" OR "Gambling" OR "Suspicious" OR "Scam/Questionable/Illegal" OR "Proxy Avoidance" | stats count by src_ip | sort count desc

I also to have those categories in a lookup table:

Potentially Unwanted Software
Gambling
Suspicious
Scam/Questionable/Illegal
Proxy Avoidance"

I would like to have a query like this:

lookup malicious_sites.csv | search * | stats count by src_ip | sort count desc

Somehow it is not working, can you guys help me out what I'm doing wrong?

V

[Akili]

me too, no results found

[vfm]

Hello Ayn,

thanks for you response.
I tried your query, because it looked exactly like what I wanted. And yes, in both my lookup and the events the field is category
However it returns no results, whereas when I put the categories in my query, I do get results.

This happens also when I try examples I find in the documentation. Somehow there is still something incorrect.

Regards,
V

[Ayn]

lookup doesn't work like that. You should read the docs on the lookup command and the inputlookup command.

What you want is probably something like this (assuming your field for this is called "category" in both the lookup and your events):

[inputlookup malicious_sites.csv | fields category] | stats count by src_ip | sort - count