Getting Data In

Using lookup table for whitelisting CIDR ranges in SPL and getting zero results

rip_leroi
Explorer

I'm brand new to Splunk and I'm having difficulty getting a query to return the results I'm looking for. I've checked the knowledge base and I see references to using transforms.conf and props.conf, but I'm in an Enterprise environment, and I don't have access to change those files.

I have a .csv lookup I've created that contains a column for CIDR ranges and a column to indicate whether the CIDR range should be whitelisted from search results. I'm trying run a query for any SMB that is incoming from the internet. My query is listed below.

index=netfw sourcetype=cisco:asa dest_port=445 NOT Cisco_ASA_action=teardown NOT transport=icmp
| lookup smbwhitelist.csv dest_ip OUTPUTNEW iswhitelist as whitelist
| search NOT whitelist IN ("yes")

This returns all traffic including all the CIDR ranges that I'm trying to whitelist and exclude from the search results. If I remove the NOT from the search, then I receive no results. However, if I manually paste in the CIDR ranges I get results, so I'm missing something.

Any pointers in the right direction would be greatly appreciated.

0 Karma
1 Solution

HiroshiSatoh
Champion

Since it is 0, the value is different, or the field does not exist.
Check the value set for ”whitelist ”.

As a result

 index=netfw sourcetype=cisco:asa dest_port=445 NOT Cisco_ASA_action=teardown NOT transport=icmp
 | lookup smbwhitelist.csv dest_ip OUTPUTNEW iswhitelist as whitelist

View solution in original post

HiroshiSatoh
Champion

Since it is 0, the value is different, or the field does not exist.
Check the value set for ”whitelist ”.

As a result

 index=netfw sourcetype=cisco:asa dest_port=445 NOT Cisco_ASA_action=teardown NOT transport=icmp
 | lookup smbwhitelist.csv dest_ip OUTPUTNEW iswhitelist as whitelist

rip_leroi
Explorer

This doesn't return any results but thank you for the suggestion.

0 Karma

HiroshiSatoh
Champion

If the result is not returned so far, it is not a problem of the subsequent condition.

0 Karma

rip_leroi
Explorer

You were correct. I removed the NOT Cisco_ASA_action=teardown NOT transport=icmp and started seeing results. Apparently, my whitelist excluded every alert and there were no other matching record. I appreciate you taking the time to help.

0 Karma

integratorz
Path Finder

Hey @rip_leroi,

Please try this search and let me know how it works.

 index=netfw sourcetype=cisco:asa dest_port=445 Cisco_ASA_action!=teardown transport!=icmp
 | lookup smbwhitelist.csv dest_ip OUTPUT iswhitelist as whitelist
 | search whitelist!="yes"
0 Karma

rip_leroi
Explorer

I appreciate the comment. This returns all results including the CIDR ranges that I'm looking to exclude.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...