All, I know there are a lot of postings with answers on lookup tables but I am still stuck.  I have not splunked in a few years and i hit a wall even when looking back at some of my old saved strings. I have a csv file that has 2 columns.  One that contains IPAddress and the other that has SubnetMasks I am searching in my logs for IPAdresses that i want to compare with the IPAddresses that are in the lookup csv file.  if the IPAddresses are not found ... then display them in a table. MY query is as follows: index=blah  field3="*" | fields field3 field4 | dedup field3 | rename field3 as Source_IP | lookup ip_whitelist IPAddress AS Source_IP | eval InWhitelist="Yes" | table Source_IP IPAddress field4 InWhitelist | where InWhitelist="Yes" | sort -Source_IP where field3 is the field with the IP Addresses (extracted from delimited extractions) where field4 is the field that has the hostname This spits out a nice table but i notice IPs that are not in my whitelist are showing up. What is wrong here !?  Your help is greatly appreciated !  Thanks P ... View more

All, I installed the REST API Modular Input add-on ( app 1546) and configured it to get twitter feeds from http discoveredintelligence . ca / stream-twitter-splunk-10-simple-steps .... sorry I do not have enough points to post links It was working great with Splunk seeing the fields and stripping them out for the "Interesting Fields" section. We wanted to modify the REST API call and add some more tags to ingest into splunk. The instructions told us that the API Call configuration would be in etc/system/loca/inputs.conf and sure enough it was there. We edit the config and added a few more tags ... restarted Splunk and there the new tags where injested. We noticed that we were just getting tags and not actual tweets from specific users, so I figured we create a new API call for "follows" to ingest tweets on specific people we "follow". Instead it was suggested to just copy the config in the inputs.conf and modify it. This was done and after restarting Splunk ... splunk stopped stripping out "interesting fields" I figured doing the copy of the config messed it up, so I decided to clear out the twitter index and delete the REST API app and reinstall it and start fresh. I did this, but every time I re-install the REST API add-on, twitter data just starts flowing back into the twitter index even before I can enter a new API call. I cleared the config from inputs.conf and deleted the REST API ... where else can there be configurations for the API call that is causing the API to call automatically upon re-installation with out setting up the new API Call ?? Any help would be great ! Thanks Pete ... View more

I have dbdump from my vulnerability software RetinaCS and dbdump from McAfee. I want to compare the assetNames field and return back to me the retina assetNames that are not found in McAfee. this would help with listing machines that do not have AntiVirus installed: Professional Services created a dashboard with the Search: index=database_dump sourcetype="retinacs-database-view-asset" AssetName="*" | fields AssetName, index, OSName, DomainName, IPAddress, LastUpdateDate | dedup AssetName | eval AssetHostName=upper(AssetName) | append [search sourcetype="symantec-db-clients" | dedup COMPUTER_NAME | eval UPPERCaseSymantecAssetName=upper(COMPUTER_NAME) | eval AssetHostName=UPPERCaseSymantecAssetName | fields AssetHostName, index ] | regex AssetHostName!="[0-9].*" | search NOT AssetHostName=*CLUSTER* NOT OSName=*Linux* NOT OSName=*Blue* NOT OSName=*Cent* NOT OSName=*ESX* NOT OSName=*iLO* NOT OSName=*Integrated* NOT OSName=FreeBSD* NOT OSName=*LaserJet* NOT OSName=*MAC* DomainName=DMC |stats count, values(IPAddress) as IPAddress, values(DomainName) as Domain, values(OSName) as OperatingSystem, values(LastUpdateDate) as LastUpdateDate, values(index) as Source by AssetName | search count=1 Source=database_dump | fields - count Source This does not work as I am getting a list that also has Assets that are in both dbs ! ... View more