Hello,
I'm trying to do a search for requests made to a list of malicious domains defined in a csv file, but excluding a list of source IPS. So far this is what I have, but I get no results:
sourcetype=bro OR sourcetype=Proxy [inputlookup Malware_Domains.csv| fields Malware_Domains] NOT [inputlookup Exclude_IP.csv| fields Exclude_IP]
My desired results will be all the IPs not in the exclude list, that are going to domains in the malware domains list, however currently I get 0/0 where as if I do my search with a Malwaredomain1 OR malware domain2 src_ip=!x.x.x.x AND src_ip=!x.x.x.x.... I get multiple results. I'm simply just trying to clean up this search and learn how to import CSVs
@karatyman Try this
sourcetype=bro OR sourcetype=Proxy [inputlookup Malware_Domains.csv| eval search="*".Malware_Domains."*" | fields search ] NOT [inputlookup Exclude_IP.csv| rename Exclude_IP as src_ip | fields src_ip]
Where are the lookup files located? Are they in: Splunk\etc\system\lookups?
What is also important are the field names in the csv files. I see that you are calling the fields: Malware_Domains and Exclude_IP. With your current search you would have to have fields that match that name in the proxy and bro sourcetypes. You could add before | fields:
| rename Exclude_IP AS dest_ip
dest_ip would be whatever the IP field in your logs is. Hope this helps.