Hello,
I have a search that's coming back with 'src' which is the source IP of a client, and I have a lookup file called "networks.csv" that has a column with a header 'ip' which is a list of CIDR networks. I have gone into the lookup definitions and set under the advanced options "CIDR(ip)" for that lookup file. I can see the headers being automatically being extracted in that UI. However, when I run the search and try to pull the category for the 'src' respective network, it does not work.
basesearch
| lookup networks.csv ip as src_ip OUTPUT category
I have validated that it's a CIDR issue by doing a "...| rex mode=sed field=src_ip " and placing a literal CIDR entry in there and having the category come out.
Thank you for your help!
Do you have the same issue when referencing the lookup definition itself instead of the CSV file?
Example:
<base_search>
| lookup <lookup definition pointing to networks.csv> ip as src_ip OUTPUT category
I think that the advanced settings may only be applied when referencing the definition.
Do you have the same issue when referencing the lookup definition itself instead of the CSV file?
Example:
<base_search>
| lookup <lookup definition pointing to networks.csv> ip as src_ip OUTPUT category
I think that the advanced settings may only be applied when referencing the definition.
Thank you! That was it.