Splunk Search

Splunk query filtering on lookup table csv

vfm
New Member

Hello,

I have a query which shows me whether malicious sites have been accessed per client ip:

"Potentially Unwanted Software" OR "Gambling" OR "Suspicious" OR "Scam/Questionable/Illegal" OR "Proxy Avoidance" | stats count by src_ip | sort count desc

I also to have those categories in a lookup table:

Potentially Unwanted Software
Gambling
Suspicious
Scam/Questionable/Illegal
Proxy Avoidance"

I would like to have a query like this:

lookup malicious_sites.csv | search * | stats count by src_ip | sort count desc

Somehow it is not working, can you guys help me out what I'm doing wrong?

V

Tags (2)
0 Karma

Akili
Path Finder

me too, no results found

0 Karma

vfm
New Member

Hello Ayn,

thanks for you response.
I tried your query, because it looked exactly like what I wanted. And yes, in both my lookup and the events the field is category
However it returns no results, whereas when I put the categories in my query, I do get results.

This happens also when I try examples I find in the documentation. Somehow there is still something incorrect.

Regards,
V

0 Karma

Ayn
Legend

lookup doesn't work like that. You should read the docs on the lookup command and the inputlookup command.

What you want is probably something like this (assuming your field for this is called "category" in both the lookup and your events):

[inputlookup malicious_sites.csv | fields category] | stats count by src_ip | sort - count
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...