Getting Data In

CSV Filter / Automated lookups issue. Need to NOT show items in CSV

ahucker
New Member

Hi All,

Relatively new to Splunk, but am making good progress.

I have a unique situation. I have an ASA logging its ACL deny entries to Splunk. All working great. I want to give some context around the issue. Currently I am migrating firewalls for a customer. We have a list of deny logs from the old firewall. Because this traffic is ALREADY being denied, we do not want to show it on the new firewall when we initially do the cutover. So essentially I need a NOT filter based on my CSV file.

Which raises another question, will Splunk match on source, dest, and port (all columns in my CSV) all as one search item, or does it match any of the three? I need it to match source, dest, and port as one.

I also have a CSV file that includes three columns. SourceIP, DestinationIP, and DestinationPort. I want Splunk to filter these when I search, and one of the two following things depending on what Splunk is capable of:

Do NOT show results matched in CSV file, but show everything else, or
Show results in CSV file as highlighted, and continue to show items not matched in CSV file.

From what I can tell so far I can get the CSV file to filter, but it ONLY shows me results matched, not the other data that was not matched. This kind of makes sense as what I want to do is somewhat backwards.

Any help would be fantastic.

Cheers.

Tags (1)
0 Karma

dart
Splunk Employee
Splunk Employee

Assuming you have a CSV file like this:

SourceIP,DestinationIP,DestinationPort,Status
127.0.0.1,127.0.0.1,8000,deny

Then search like so:

sourcetype=cisco_asa | lookup my_lookup_name SourceIP DestinationIP DestinationPort OUTPUT Status | search NOT Status=deny

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...