check if a field value is in a specific reference set list

[horsefez]

Hi,

I have data, which I want to filter based on the IP-addresses that are contained in a .csv file.

For example my events look like:
Event_1 192.168.1.1
Event_2 192.168.1.2
Event_3 192.168.1.3
Event_4 192.168.1.1
Event_5 192.168.1.2
Event_6 192.168.1.3
Event_7 192.168.1.2
Event_8 192.168.1.2
I extracted the IP's as SOURCE_IP

I now want to filter on events, whose SOURCE_IP are contained in the IP_whitelist.csv
IP_whitelist.csv looks like that:
192.168.1.3,
192.168.1.1

Anyone any idea how the search string needs to be assembled?

Thanks in advance!

[asimagu · Accepted solution]

You could have a lookup table with your whitelist, then keep only the records that match your lookup

That way you could alter your whitelist file manually without affecting the splunk query

[horsefez]

Cool, would you be able to help me with my search syntax a bit, I have problems with the lookup

My search looks like
sourcetype=application1 [|inputlookup ip_whitelist | fields whitelistip]
but somehow the search does not return any events... any clues?

Thank you so far!

[aholzer]

@horsefez just rename whitelistip to SOURCE_IP inside your subsearch
sourcetype=application1 [|inputlookup ip_whitelist OUTPUT whitelistip AS SOURCE_IP | fields SOURCE_IP]