Knowledge Management

Lookup and Correlation Help

dmenon
Explorer

I have lookup that has 2 columns IP address and hostname , I see output when I run command | inputlookup serverip.csv. Now, I want to use these IPs to look at src_ip field in firewall logs and find matches, after match look at destinations like dest_ip,dest_location etc.

| inputlookup serverip.csv and then other query index=firewall | stats values(dest_IP),values(url),values(dest_location) by src_ip , where the src_ip is the IP from the csv.

How do I do the correlation, also the csv as server name which I would like to pull into the output. Thanks in advance for any help.

Tags (1)
0 Karma

Vijeta
Influencer

@dmenon Try the below

index=firewall | append[| inputlookup serverip.csv |rename IP as src_ip]| stats values(dest_IP),values(url),values(dest_location) by src_ip 
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...