Threat Intelligence source fails to save or process from a custom IPv4 IOC CSV in Splunk Enterprise Security (ES)

Applicability

Description

A custom CSV containing IPv4 indicators with an ip,description header is uploaded through Configure > Threat Intelligence > Data Sources > Add Data Source > Upload.

When Save is selected in the Add Intelligence Document dialog:

• The General section is highlighted in red.
• Save becomes unavailable.
• No validation details are displayed.

Indicators appended manually with outputlookup are written to ip_intel. However, these rows lack source metadata such as threat_key and do not appear in Threat_Intelligence.Threat_Activity.

Example CSV structure:

ip,description
XXX.XXX.XXX.XXX,Example exploitation source
XXX.XXX.XXX.XXX,Example attempt indicator

Investigation

Run all searches on the ES search head in the SplunkEnterpriseSecuritySuite app context. The ip_intel lookup is app-scoped and returns no results from Search & Reporting.

1. Confirm the CSV is readable as a lookup:

| inputlookup <lookup_file>.csv

2. Review the source configuration, including the fields and skip_header_lines values:

| rest /services/data/inputs/threatlist splunk_server=local
| search title="*<source_name>*"
| table title disabled type weight interval max_age fields skip_header_lines

3. Check the Threat Intelligence logs for processing errors, or for no records written to ip_intel. Adjust earliest and latest to the time window when the issue occurred:

index=_internal (source=*threatlist.log* OR source=*threat_intelligence_manager.log*) "<source_name>" earliest="10/30/2026:00:00:00" latest="10/30/2026:04:00:00"

4. Check whether indicators in ip_intel are missing threat_key. Missing values mean the rows were added manually rather than processed by a source:

| inputlookup ip_intel
| search ip="XXX.XXX.XXX.XXX"
| table ip description threat_key time weight

Cause

The root cause of the red General section on Upload has not been isolated.

Two related behaviors are confirmed:

• A Fields mapping such as ip:$1,description:$2 causes processing failures for this CSV format.
• Indicators added with outputlookup bypass the Threat Intelligence framework, so they lack source metadata such as threat_key.

Resolution

1. Create the CSV as a lookup that ES can read:
   1. Go to Settings > Lookups > Lookup table files > New.
   2. Set Destination app to SplunkEnterpriseSecuritySuite.
   3. Upload the CSV and set the destination file name to <lookup_file>.csv.
   4. Select Save.
   5. Open Permissions for the file. Share it with All apps (system) and grant read access to the required roles.
   6. Go to Settings > Lookups > Lookup definitions > New and set:
      • Destination app: SplunkEnterpriseSecuritySuite
      • Name: <lookup_name>
      • Type: File-based
      • Lookup file: <lookup_file>.csv
   7. Set the lookup definition permissions to match the lookup table file.
2. Go to Configure > Threat Intelligence > Data Sources > Add Data Source.
3. Set the source URL to the lookup definition name:

lookup://<lookup_name>

4. Set Parsing as follows:
   • File Parser: auto
   • Fields: leave blank. Do not enter a mapping such as ip:$1,description:$2.
   • Skip header lines: 0
5. Save the source.
6. Confirm records were written to ip_intel. Adjust the time range to when the source was saved:

index=_internal source=*threatlist.log* "<source_name>" earliest="10/30/2026:00:00:00" latest="10/30/2026:04:00:00"

7. Run the ip_intel search from Investigation Step 4. Confirm threat_key, time, and weight are populated.

Related Links

• Add threat intelligence sources