I am looking for a way to perform a search and produce results matching search results against a lookup table or vice versa. The scenario is a lookup table with two columns, IP & Description. I wish to run a search and produce results on the IP addresses that match the IP addresses in the lookup table. My syntax is not correct on what I have been able to test, see below for the SPL I was using. I know there must be a straight forward way to accomplish this task. Much appreciated for any support.
Thank you,
Tom
index="network" sourcetype="cisco:asa" | join src_ip [ search inputlookup append=t FLASHAB000089 | rename IPAddr as src_ip]
Here's the syntax I use for such cases:
index="network" sourcetype="cisco:asa"
[ | inputlookup FLASHAB000089
| stats values(IPAddr) as src_ip
| format ]
The syntax in the accepted answer works great but when I create a lookup table with UrLs, it does not work. Any ideas on how to use a lookup table with UrLs? I have SPL like this that isn't working,
index="p*" [ | inputlookup UrL-Input | stats values(UrL) as url | format ] | stats count by src_ip,url,action
| sort action
The lookup table UrL-Input contains two columns, URL & Description.
Any assistance is appreciated.
Tom
Just tried it and working with a control IP i added to the lookup table. Thank you very much!
Here's the syntax I use for such cases:
index="network" sourcetype="cisco:asa"
[ | inputlookup FLASHAB000089
| stats values(IPAddr) as src_ip
| format ]