Splunk Search
Highlighted

how to whitelist using lookup table

New Member

we have threat logs from firewall. That log contains a signature, which is captured under signature field. my requirement here is to white list 3 fields(signature, source and destination) simultaneously. What i am currently doing is create a lookup table, that 3 columns(signature, source and destination) and their respective value.
I am using the below query, however its doesnt work

index= firewall NOT[|inputlookup whitelist.csv | fields signature,source,destination]

0 Karma
Highlighted

Re: how to whitelist using lookup table

SplunkTrust
SplunkTrust

Try formatting the results of the subsearch.

index= firewall NOT[|inputlookup whitelist.csv | fields signature,source,destination | format]
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: how to whitelist using lookup table

Super Champion

Your query should have worked.. i.e.

index= firewall NOT [|inputlookup whitelist.csv | fields signature,source,destination]

But please ensure your data in index=firewall contains precisely the fields signature, source, destination (The field names are case-sensitive too) and contains ALL of the fields in each Event. If a single field is missing, you will get empty results.

to debug this, do the fields individually, and test if each of the field works. something like below and test for each field

index= firewall NOT [|inputlookup whitelist.csv | fields signature]

..

0 Karma