I am a Splunk noob, and I am trying to make a lookup work. Specifically, I am creating a lookup table of IP addresses, which I then want to compare to my outbound firewall connections which target the IPs in the lookup.
Sample from the lookup CSV (file named bad_guys.csv):
sourcetype="cisco:asa" [lookup bad_guys.csv Mal_IPs as dest_ip]
When I run this search, I get the following error:
Error in 'lookup' command: All of the fields in the lookup table are specified as lookups, leaving no destination fields.
Pretty sure I am doing something bone-headed, but can't seem to figure out what it is. Any ideas? Thanks in advance!
Not a bone-headed question, there is a fix and what you did was what I started off doing as well.
The challenge is that when using the lookup command with a lookup that has a single value in it, you need to have an OUTPUT defined otherwise, it does not have anything to show for the lookup that it performed.
In your case, | lookup bad_guys.csv Mal_IPs as dest_ip OUTPUT Mal_IPs is what I would probably do.
Keep in mind, that will return all relevant rows in the search whether or not a match occurs. The next line under my lookup would likely be | search Mal_IPs=* which will just return values that have a Mal_IPs in it, those will be the matches.
There are other ways of doing this as well but hopefully this gets you going in the right direction.