Splunk Search

Splunk query on lookups

umeshcreddy
Engager

Hi 

Actually i made  lookup with the list of ip address in .csv file. I want to write a query if there is traffic from the ip address which i had given in the lookups.

Please help me woth the query. i have the Web datamodel as well

 

Thanks & Regards,

Umesh Chandra Reddy 

Labels (1)
0 Karma

ldongradi_splun
Splunk Employee
Splunk Employee

You don't say where the traffic analysis comes from ... Any index, source, sourcetype ?

Do you want to analyze the activity toward the Splunk Web server itself ? If so, you would start looking in

index=_internal  source=splunkd_access.log sourcetype=splunkd_ui_access clientip=*

Here the clientip is the field that tells you about the incoming connection.

If you want to compare it with the lookup you can then add this :

... | LOOKUP <lookup.csv/lookup definition> clientip OUTPUTNEW clientip AS knownIP

If the ip address is in the csv, then it will be shown in the knownIP field.

If it is unknown, the knownIP field will be inexistent.

After what you can filter the results based on the existence of that knownIP field, with:

| where isnull(knownIP)

or

| where isnotnull(knownIP)

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...