Splunk Search

Write a request

gitingua
Communicator

Need help writing a request

file1.csv 

usernamesrc_ip
John192.168.16.35
Smith172.167.3.43
Aram132.56.23.3

 

file2.csv

IP addressASNOther
192.168.16.0/241234RU
172.167.3.0/244321AG
132.56.23.0/246789BR

 

output 

usernamesrc_ipasnother
John192.168.16.351234RU
Smith172.167.3.434321AG
Aram132.56.23.36789BR

 

 

Thanks guys !!!!

Labels (4)
0 Karma
1 Solution

nmohammed
Builder

file1.csv -- > csv based lookup

file2.csv -->  cidr based lookup (I've renamed "IP Address" field to ip_address) 

Add a new lookup definition, name it "file2"  and select file2.csv

Check on advanced options.  In "Match type"  type in "CIDR(ip_address)" .

nmohammed_0-1634776466572.png

 

| inputlookup file1.csv 
| fields src_ip, username
| lookup file2 "ip_address" as src_ip output ASN, Other

 

View solution in original post

nmohammed
Builder

Hi @gitingua 

 

try this out, assuming you've these files uploaded as lookups

 

 

| inputlookup file1.csv 
| appendcols 
    [inputlookup file2.csv 
    |  fields ASN,Other ]
| table username,src_ip,ASN,Other

 

0 Karma

gitingua
Communicator

@nmohammed 

No no no no. 

if the first three src_ip values match the IP address. then takes on these values

if src_ip(192.168.16.35) = IP address(192.168.16.0/24)

 

0 Karma

nmohammed
Builder

file1.csv -- > csv based lookup

file2.csv -->  cidr based lookup (I've renamed "IP Address" field to ip_address) 

Add a new lookup definition, name it "file2"  and select file2.csv

Check on advanced options.  In "Match type"  type in "CIDR(ip_address)" .

nmohammed_0-1634776466572.png

 

| inputlookup file1.csv 
| fields src_ip, username
| lookup file2 "ip_address" as src_ip output ASN, Other

 

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...