Splunk Search

inputlookup

timgmanCORP
Observer

I have a csv with ip addresses. I would like to conduct a search for addresses that are NOT listed in that csv. 

I was attempting the following but it does not render the results I was expecting. I want to search for ip addresses that are not in that list.           IE: unknown address... 

Splunk Enterprise Security 

index=myindex
| rex "(?<ip>\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b)" | sort ip | table ip NOT [inputlookup known_addresses.csv]
Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

inputlookup is the wrong approach to finding events that do not have a match. (Unless you don't have a choice, or if it is applicable in index search, inputlookup is usually wrong.)  lookup command is way more efficient.

index=myindex
| rex "(?<ip>\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b)"
| lookup known_addresses.csv ip output ip as match
| where isnull(match)
| sort ip
| table ip

 

Tags (1)

marnall
Motivator

I recommend first running a search using only inputlookup to ensure that your IP addresses are returning properly:

| inputlookup known_addresses.csv

You should get a single column of addresses with the "ip" field name.

ip
192.168.1.1
123.123.123.123
222.111.133.111


Then you can put it into a negated search filter in your main search: (I haven't checked your regex, so assume it works to create a field of "ip" with an ip address value.)

index=myindex
| rex field=_raw "(?<ip>\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b)"
| search NOT [| inputlookup known_addresses.csv]
| sort ip
| table ip

If the regex does not work, you can try this one:

index=myindex
| rex field=_raw "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| search NOT [| inputlookup known_addresses.csv]
| sort ip
| table ip


You may also want to put dedup at the end, to remove duplicate ip addresses:

...
| dedup ip

 

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...