Hello - I am trying to construct a search whereby I can do a lookup of a single table, then rename the fields and change how they're displayed, however the lookup and eval commands don't seem to be w...
See more...
Hello - I am trying to construct a search whereby I can do a lookup of a single table, then rename the fields and change how they're displayed, however the lookup and eval commands don't seem to be working as I would like. The main search I am performing is basic, using some source subnets and then trying to have the lookup reference what area of the business they belong to, below is the lookup portion of my search:
index="logs" sourceip="x.x.x.x" OR destip="x.x.x.x"
| lookup file.csv cidr AS sourceip OUTPUT field_a AS sourceprovider, field_b AS sourcearea, field_c AS sourcezone , field_d AS sourceregion, cidr AS src_cidr
| lookup file.csv cidr AS destip OUTPUT field_a AS destprovider, field_b AS destarea, field_c AS destzone, field_d AS destregion, cidr AS dest_cidr
| fillnull value="none"
| eval src_details_combined=sourceprovider."-".sourcearea."-".sourcezone ."-".sourceregion
| eval dest_details_combined=destprovider."-".destarea."-".destzone."-".destregion
| eval src_details_combined=IF(src_details_combined=="none-none-none-none","notfound",src_details_combined)
| eval dest_details_combined=IF(dest_details_combined=="none-none-none-none","notfound",dest_details_combined)
| stats count values(sourceip) as sourceip values(destip) as destip by src_details_combined, dest_details_combined, rule, dest_port, app
| table src_details_combined, dest_details_combined, app, count
When I run the search I do get some results but the src_details_combined and dest_details_combined fields always return as "notfound" - even though I know the IPs should match in the lookup csv. Can anyone see where I have gone wrong in my search?