Splunk Search

UC_tor_traffic

pavanbmishra
Path Finder

Hey guys,

Is there any way how splunk get this lookup update itself or do we need to manually feed it? if yes what is the way around. Thanks

Tags (2)
0 Karma

jkat54
SplunkTrust
SplunkTrust

You need to provide more details. What app, what version of splunk, why are you updating it, how do you want to update it...?

0 Karma

pavanbmishra
Path Finder

Thanks,

I am using Splunk Security Essential App here, the rule comes as part of this app named: Basic TOR Traffic Detection

Here is the SPL being called

inputlookup UC_tor_traffic
| search app=tor src_ip=*
| table _time src_ip src_port dest_ip dest_port bytes app

When i checked the content of lookup: UC_tor_traffic, it shows the old data having dates of 2017, may be the dummy one. Curious about how to update this table and what is the way around.

Thanks in advance

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...