Splunk Search

Splunk query on lookups



Actually i made  lookup with the list of ip address in .csv file. I want to write a query if there is traffic from the ip address which i had given in the lookups.

Please help me woth the query. i have the Web datamodel as well


Thanks & Regards,

Umesh Chandra Reddy 

Labels (1)
0 Karma

Splunk Employee
Splunk Employee

You don't say where the traffic analysis comes from ... Any index, source, sourcetype ?

Do you want to analyze the activity toward the Splunk Web server itself ? If so, you would start looking in

index=_internal  source=splunkd_access.log sourcetype=splunkd_ui_access clientip=*

Here the clientip is the field that tells you about the incoming connection.

If you want to compare it with the lookup you can then add this :

... | LOOKUP <lookup.csv/lookup definition> clientip OUTPUTNEW clientip AS knownIP

If the ip address is in the csv, then it will be shown in the knownIP field.

If it is unknown, the knownIP field will be inexistent.

After what you can filter the results based on the existence of that knownIP field, with:

| where isnull(knownIP)


| where isnotnull(knownIP)

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...