Splunk Search

Match IP from main search to an IP in lookup file and output only the events that match from the main search

carldipace
New Member

I have my main search below. I want to match ip's from my main search to the ip's in my lookup file and output only the events that match. The lookup file field for my ip's is "host_ip" and the field in my main search is "dest_ip".

index=fda_sec_suricata sourcetype=suricata (src_ip!=10.X.X.X/X AND src_ip!=172.X.X.X/X AND src_ip!=192.X.X.X/X) (host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X") |
eval CVE_listed=if(isnotnull(reference_cve) OR like(signature,"%CVE"),1,0) | rex field=signature "CVE-(?\d+-\d+)" |
eval reference_cve="CVE-".reference_cve |
search (CVE_listed=1) |
dedup reference_cve, src_ip, src_port, dest_ip, dest_port |
table category, signature, severity, reference_cve, reference_url, src_ip, src_port, dest_dns, dest_nt_host, dest_ip, dest_port, _time

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

index=fda_sec_suricata sourcetype=suricata (src_ip!=10.X.X.X/X AND src_ip!=172.X.X.X/X AND src_ip!=192.X.X.X/X) (host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X")  [| inputlookup YourLookup.csv | table host_ip | rename host_ip as dest_ip ]
| eval CVE_listed=if(isnotnull(reference_cve) OR like(signature,"%CVE"),1,0) | rex field=signature "CVE-(?\d+-\d+)" 
| eval reference_cve="CVE-".reference_cve 
| search (CVE_listed=1) 
| dedup reference_cve, src_ip, src_port, dest_ip, dest_port 
| table category, signature, severity, reference_cve, reference_url, src_ip, src_port, dest_dns, dest_nt_host, dest_ip, dest_port, _time
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...