Splunk Search

how to cross

4nton10
Loves-to-Learn Lots

good day.

I am somewhat new to splunk, I am trying to generate a cross between some malicious IP s I have in a file. csv and I want to compare them with src_ip field and if there are coincidences I throw the result, I understand that you have to generate a lookup but I can not move any further

Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

You need to give clearer description.  For example, does the phrase "throw the result" mean to discard event when src_ip is found in file.csv or to only preserve matching events in order to raise an alert?  Have you read command document for lookup?

Here I will give an example assuming that your goal is actually to preserve matching events, and assuming that file.csv contains a single column malicious_ip.

| lookup file.csv src_ip as malicious_ip output malicious_ip as matching
| where isnotnull(matching)

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...