cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
Erfan
Explorer
Member since: ‎03-28-2023
‎04-17-2023
Community Statistics
Posts 5
Solutions 0
Karma Given 2
Karma Received 0
Member Since ‎03-28-2023
Activity Feed
View All

How to use wildcard in multi fields in lookup tabl...

by in Alerting
‎04-17-2023 06:33 PM
‎04-17-2023 06:33 PM
Hi I want to use a lookup table as a whitelist for an alert. 1. I created a whitelist.csv lookup table including src, dst, protocol, user, whitelisted src  |  dst  | protocol  | user | whitelisted 192.168.10.1 | 120.18.97.6 | * | * | true 192.168.10.5 | * | * | * | true * | * | https | bob | true 2. I created a lookup definition with match type:  WILDCARD(src), WILDCARD(dst), WILDCARD(user), WILDCARD(protocol) 3. Added following line to my search: | lookup whitelist.csv src user dst protocol | where isnull(whitelisted)   But is does not work. Do I need to change anything? ... View more
Labels

Re: Look up table with "*" or "any&...

by in Splunk Search
‎04-02-2023 05:01 PM
‎04-02-2023 05:01 PM
Thank you so much. The only vague part for me is that how to create match type for wildcard on all fields in GUI version. I think this works for CUI:  field1,field2,field3,output_field,match_type value1,value2,value3,output_value,*   But I do not have acccess to CUI and it is just GUI. So I defined WILDCARD(*) but did not work. ... View more

Re: Look up table with "*" or "any&...

by in Splunk Search
‎03-30-2023 09:26 PM
‎03-30-2023 09:26 PM
Thank you Yuanliu let me rephrase my question, maybe lookup is not a good solution for my problem. Actually I want to whitelist following traffic on search of fortigate's logs: Traffic from 172.16.20.12 to every where traffic from 192.168.26.8 to 198.160.25.74 traffic from every where to 142.250.70.174 traffic from any to any related to a specific user (Alice)   All records include all fields. ... View more

Re: Look up table with "*" or "any&...

by in Splunk Search
‎03-29-2023 04:43 PM
‎03-29-2023 04:43 PM
Thanks for your response.  I created a look up definition and in match type I entered:  WILDCARD(dest_ip) I expected to see all result except traffic from 172.16.20.13: 172.16.20.13 * * * * TRUE   but it did not showed any records. I mean it remove all result not only whitelisted.   ... View more

How to create a look up table with "*&" or "any" f...

by in Splunk Search
‎03-28-2023 10:04 PM
‎03-28-2023 10:04 PM
Hi I am trying to whitelist some traffic from my search. So I decided to create a look up table including src ip, dst ip, username, dst port, src zone. for example: src_ip dest_ip src_zone dest_port user whitelisted * * center * * TRUE 172.16.20.44 13.58.90.11 * 443 Alice TRUE * 128.221.236.246 * 443 * TRUE 192.168.12.03 * * * * TRUE 172.16.20.13 * * * * TRUE 192.168.26.4 * * * * TRUE 192.168.26.8 198.160.25.74 * 443 * TRUE 192.168.26.9 198.160.25.87 * * * TRUE * 142.250.70.174 * * * TRUE               but the problem is the search matches when all cells related to fields which are called in lookup command have values, but it does not match (does not whitelist) if a cell has "*" or "Any"  value. | lookup whitelisttest.csv src_ip as src_ip dest_ip as dest_ip dest_port as dest_port user as user | where isnull(whitelisted) ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎04-17-2023 10:00 PM
Karma given to
View All