Splunk Search

How to search a lookup table to find any IP addresses that match the IPs in my firewall events?

meadowh
Explorer

I have a lookup table called - c2cisp.csv. the definition is called c2cisp.
The table has a field name ip. It contains IP addresses.
I want to search through my firewall logs to check to see any events where the ip in my events field 'd_ip' matches any of the ips in the 'ip' field in my lookup table.
Seems like it should be pretty easy right?

Any help much appreciated

Tags (4)
0 Karma

meadowh
Explorer

Great thanks guys.
i had a few errors in my lookup table that caused some weird results.
All good now.

I have used this before as my guide:
search | lookup [lookup definition name] [fieldname1 in lookup table to check] as [fieldname2 in events] OUTPUT [ fieldname3 in lookuptable ] as [fieldname4 - you can create a new name] | search [fieldname4]=”*”

couldn't understand why it wasn't working this time!

matthieu_araman
Communicator

I would do something like
* | lookup c2cisp.csv ip as d_ip OUTPUT ip as c2cisp | search c2cisp=*

0 Karma

vinitatsky
Communicator

sourcetype="" | rename d_ip as ip | lookup c2cisp ip OUTPUTNEW ip | table ip,

1) | rename d_ip as ip -- Just to make sure both fields names are same (lookup field name and actual field name)
2) | lookup c2cisp ip OUTPUTNEW ip -- This command will look for 'ip' value in 'c2cisp' and will output ip field from lookup. If you want to view more fields from lookup then you can add it here.

Hope this helps.

vganjare
Builder

You can use lookup command. http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Lookup

Refer to examples section.

Thanks!!

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...