I have a blacklist.csv file that looks like the following,   IP domain 1.0.136.29 # 2018-11-12, node-1lp.pool-1-0.dynamic.totbb.net, THA, 2 1.0.136.215 # 2018-10-06, node-1qv.pool-1-0.dynamic.totbb.net, THA, 2   i want to scan my syslog events and see if any IP address match the IPs in this blacklist. a syslog event looks like this: Feb 7 03:32:31 Router kernel: [WAN_IN-3009-A]IN=eth0 OUT=eth1.100 MAC=18:e8:29:44:40:ac:00:1d:aa:a2:78:axxxxxx src=128.199.123.0 DST=192.168.100.207 LEN=60 TOS=0x00 PREC=0x00 TTL=47 ID=52834 DF PROTO=TCP SPT=38290 DPT=8194 WINDOW=29200 RES=0x00 SYN URGP=0 MARK=0x64800000 i already set up a lookup definition and lookup table, but i dont know exactly how to put up a search to display if a syslog even matches an IP in the blacklist.csv ... View more

im trying to setup splunk to find suspicious traffic in incoming and outgoing traffic. right now im trying to exclude traffic that comes from places that are not suspicious (whitelist) like social media websites, news websites, internal traffic etc. and use a blacklists to trigger alerts if it tries to connect to my IP. im not sure where to start here, is this even possible in splunk? there are existing blacklists online that use an api key to connect to for that blacklist, can i use that api key in splunk? do i download an entire database and upload it under my C: drive? i really hope you guys can help me here ... View more

i want splunk to show me the geolocation from incoming traffic. as everyone knows syslog lines can vary a lot, it is not parsed at all besides the time and date. after downloading a days worth of syslog traffic and using the "extract fields" to highlight the IP address that needs to be used to find the location it was possible to see on the world map where the traffic came from. what i need is this exact feature but for real time data, i want to see this information from the syslog file in real time. so far it hasn't worked, and i dont know how to fix it. i use the same search on both the real-time syslog and downloaded syslog file however it only works with the downloaded syslog index=_* OR index=* sourcetype=syslog | iplocation clientip | geostats count by Country     ... View more