Is there anything different when running a lookup on data returned by a pivot compared to the same lookup running on data returned from a direct search on indexed data ?
The following lookup returns 1400 matches :
tag=ids tag=attack | lookup threatlist_lookup_by_str key AS dest
OUTPUTNEW name AS dest_threatlist_name| search dest_threatlist_name=*
If the same lookup runs agains a pivot, there are no matches:
| tstats `summariesonly` count from datamodel=Intrusion_Detection where
* by _time,IDS_Attacks.src,IDS_Attacks.dest span=10m | `drop_dm_object_name("IDS_Attacks")` | lookup threatlist_lookup_by_str key AS dest OUTPUTNEW name AS dest_threatlist_name| search dest_threatlist_name=*
The root element definition of the Intrusion_Detection datamodel is the same as the direct search
The purpose of this is to integrate custom threat lists in the default ES content like the "Threat List Activity" dashboard. Most of the ES default panels use datamodel / pivot searches which causes the lookups to fail.
... View more
I need to port ArcSight content to Splunk and I'm afraid I stumbled upon a fundamental difference on how to implement filters in ArcSight vs. saved searches in Splunk.
How to filter out events by comparing two event fields against each other ?
For instance, this is a simple search on Windows events and I want to list all the events where the "host" field is different from "dest" field
by searching for host!=dest, I get all events, even those where host=dest.
If I'm comparing each of the fields to constants or strings, it works; the problem is how to compare between two event fields.
I hope I made sense and I'd appreciate any hint.
... View more