#Splunk lookup how to
#Splunk lookup download
#Splunk lookup free

In the example above, we searched the name field for any matches. Using this enrichment technique, we could then add another search command (ironically called “search”) to find all IP addresses that have a lookup match based on any of these new fields. When the ip field in the csv and the dest_ip in the log matched, the name, country_id and city fields were added to the event because all three fields (name, country_id and city) are in the open_nameservers.csv.

#Splunk lookup free

We immediately see that a workstation in the network is connecting to 8.8.88 (a free public DNS server offered by Google) to resolve DNS domains. Takes the field “ip” from the open_nameservers.csv that we defined and looks for matches in your data set in the field “dest_ip.” Whenever there is a match, Splunk adds additional context from the csv to the event. In this example, we are leveraging Splunk Stream and gathering DNS data. any servers that responded to DNS servers that are in the lookup table).ĭepending on the kind of data you have, your sourcetype may differ. Now that we have our csv loaded and defined within Splunk, we can search for matches (e.g. This definition name will be used with the lookup command. In the example below, we used the (very imaginative) name “open_nameservers” for our definition name. Click “Add New” in the “Lookup Definitions” to create a linkage between Splunk and the csv we just uploaded.

Splunk returns you to the “Lookup Tables” menu. Click “Choose File” to upload your csv and assign a “Destination Filename” (in this case we kept it simple and called it “open_nameservers.csv”) Now that we have a csv, log in to Splunk, go to 'Settings' > 'Lookups' and click the “Add new” link for “Lookup Table Files”.

#Splunk lookup download

To get started, let’s find a list of open/public DNS servers and download (or create) a csv. Perhaps you create a hypothesis that 'Malicious actors and adversaries can be detected in our network by their use of public DNS servers.” Now, how would you find these public DNS servers in your network? A good place to start would be to get a list of public DNS servers and find hosts in your network that connects to these servers. Maybe you read a recent tweet that adversaries in your network often use public DNS servers. Let’s walk through some things you may want to hunt for in your environment. However, hunting-as always-is a slightly different use case than normal Splunking. For example, if you wanted to have additional context about a user in Splunk, you could import her office number or location as a lookup, and then use the lookup command to show that in Splunk. You can also use lookups to add context to your existing data in Splunk. Often overlooked in the heat of the moment, the lookup command allows you to add csv files to Splunk and then run searches that match data in Splunk to the contents within that csv*.

#Splunk lookup how to

(AKA How to use the lookup command for hunting.) This is part one of the ' Hunting with Splunk: The Basics' series.