Hello All,
I am a Splunk noob, and I am trying to make a lookup work. Specifically, I am creating a lookup table of IP addresses, which I then want to compare to my outbound firewall connections which target the IPs in the lookup.
Sample from the lookup CSV (file named bad_guys.csv):
Mal_IPs,
12.34.56.78,
22.33.44.55,
Sample Search:
sourcetype="cisco:asa" [lookup bad_guys.csv Mal_IPs as dest_ip]
When I run this search, I get the following error:
Error in 'lookup' command: All of the fields in the lookup table are specified as lookups, leaving no destination fields.
Pretty sure I am doing something bone-headed, but can't seem to figure out what it is. Any ideas? Thanks in advance!
... View more