Splunk Search

How to use a lookup table in a search to match any IPs or domains found in a column, but ignore any values older than 90 days?

ehaile
Engager

I currently have a lookup table that contains 2 columns: date and ioc. The goal is to have Splunk go through the lookup table and match any IPs or domains it finds on the ioc column. However, I would like Splunk to disregard ioc's have been on the lookup table for 90 days or more. Any help would be great. Below is what I have so far not much 😕

index=* sourcetype=* [| inputlookup ioc.csv  | fields + ioc]|
Tags (4)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

If you just want to do a text search of IP from the lookup into your index, try something like this (assuming your data format of lookup table is %Y-%m-%d)

index=* sourcetype=* [| inputlookup ioc.csv  | where  strptime(date,"%y-%m-%d")>relative_time(now()-"-90d")| eval search=ioc | table search ]

If you just want to a field matching (like value of src_ip) of the IP from lookup table, try something like this

  index=* sourcetype=* [| inputlookup ioc.csv  | where  strptime(date,"%y-%m-%d")>relative_time(now()-"-90d")| eval src_ip=ioc | table src_ip ]

ehaile
Engager

Thanks for the response.

I am gettting the following:

"Error in 'where' command:Typechecking failed. "-" only takes numbers."

The data in the lookup is %Y-%m-%d

0 Karma

jensonthottian
Contributor

To your search string add this after removing the last pipe


NOT [ | inputlookup ioc.csv | date>"<90days>"|fields + ioc]

The <90days> should be in the format of how your date is in your CSV.

ehaile
Engager

jensonthottian,

The query keeps failing I get the following error message "Error in inputlookup command:Invalid argument: 'date>'.

Below is what I tried:

index=* sourcetype=* [| inputlookup ioc2.csv | fields + ioc] NOT [|inputlookup ioc2.csv date> "08/19/2015" fields +ioc]
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...