Splunk Search

How to use a lookup table in a search to match any IPs or domains found in a column, but ignore any values older than 90 days?

ehaile
Engager

I currently have a lookup table that contains 2 columns: date and ioc. The goal is to have Splunk go through the lookup table and match any IPs or domains it finds on the ioc column. However, I would like Splunk to disregard ioc's have been on the lookup table for 90 days or more. Any help would be great. Below is what I have so far not much 😕

index=* sourcetype=* [| inputlookup ioc.csv  | fields + ioc]|
Tags (4)
0 Karma

somesoni2
Revered Legend

If you just want to do a text search of IP from the lookup into your index, try something like this (assuming your data format of lookup table is %Y-%m-%d)

index=* sourcetype=* [| inputlookup ioc.csv  | where  strptime(date,"%y-%m-%d")>relative_time(now()-"-90d")| eval search=ioc | table search ]

If you just want to a field matching (like value of src_ip) of the IP from lookup table, try something like this

  index=* sourcetype=* [| inputlookup ioc.csv  | where  strptime(date,"%y-%m-%d")>relative_time(now()-"-90d")| eval src_ip=ioc | table src_ip ]

ehaile
Engager

Thanks for the response.

I am gettting the following:

"Error in 'where' command:Typechecking failed. "-" only takes numbers."

The data in the lookup is %Y-%m-%d

0 Karma

jensonthottian
Contributor

To your search string add this after removing the last pipe


NOT [ | inputlookup ioc.csv | date>"<90days>"|fields + ioc]

The <90days> should be in the format of how your date is in your CSV.

ehaile
Engager

jensonthottian,

The query keeps failing I get the following error message "Error in inputlookup command:Invalid argument: 'date>'.

Below is what I tried:

index=* sourcetype=* [| inputlookup ioc2.csv | fields + ioc] NOT [|inputlookup ioc2.csv date> "08/19/2015" fields +ioc]
0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...