Splunk Search

How would I use lookup in this search?

faiq1999
Explorer

Hi everyone, I created a CSV lookup that has one column named "IP" which contains public IP list, and now I want to use these values inside my searches. For instance when I try to search incoming traffic to our firewall then I want to use the lookup's values in the dest_ip field for my base search. Could you help me, please?

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

If by "use the lookup's values in the dest_ip field for my base search" you mean you want to discard any event in which dest_ip does not match any value of IP in the lookup, this is how to do it with a subsearch:

sourcetype = my_firewall_log
  [| inputlookup my_lookup.csv
  | rename IP as dest_ip]

 

View solution in original post

Tags (2)

faiq1999
Explorer

Thank you both

0 Karma

yuanliu
SplunkTrust
SplunkTrust

If by "use the lookup's values in the dest_ip field for my base search" you mean you want to discard any event in which dest_ip does not match any value of IP in the lookup, this is how to do it with a subsearch:

sourcetype = my_firewall_log
  [| inputlookup my_lookup.csv
  | rename IP as dest_ip]

 

Tags (2)

gcusello
SplunkTrust
SplunkTrust

Hi @faiq1999,

You have two solutions:

one more performant, that requires that you have to identify the fields for searching (e.g. src_ip, dst_ip) and create a calculated field or insert it in the search (the calculated field is more performat!)

index=your_index
| eval IP=coalesce(src_ip,dst_ip)
| search [ | inputlookup your_lookup.csv | fields IP ]

the second solution is easier but less performant:

index=your_index [ | inputlookup your_lookup.csv | rename IP AS query | fields query ]

because it performs a full text search.

Ciao.

Giuseppe

 

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...