Splunk Search

Splunk query filtering on lookup table csv

vfm
New Member

Hello,

I have a query which shows me whether malicious sites have been accessed per client ip:

"Potentially Unwanted Software" OR "Gambling" OR "Suspicious" OR "Scam/Questionable/Illegal" OR "Proxy Avoidance" | stats count by src_ip | sort count desc

I also to have those categories in a lookup table:

Potentially Unwanted Software
Gambling
Suspicious
Scam/Questionable/Illegal
Proxy Avoidance"

I would like to have a query like this:

lookup malicious_sites.csv | search * | stats count by src_ip | sort count desc

Somehow it is not working, can you guys help me out what I'm doing wrong?

V

Tags (2)
0 Karma

Akili
Path Finder

me too, no results found

0 Karma

vfm
New Member

Hello Ayn,

thanks for you response.
I tried your query, because it looked exactly like what I wanted. And yes, in both my lookup and the events the field is category
However it returns no results, whereas when I put the categories in my query, I do get results.

This happens also when I try examples I find in the documentation. Somehow there is still something incorrect.

Regards,
V

0 Karma

Ayn
Legend

lookup doesn't work like that. You should read the docs on the lookup command and the inputlookup command.

What you want is probably something like this (assuming your field for this is called "category" in both the lookup and your events):

[inputlookup malicious_sites.csv | fields category] | stats count by src_ip | sort - count
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...