topic Re: Search for ip in lookup based on system alias in csv in Getting Data In

Search for ip in lookup based on system alias in csv

Trusty — Wed, 24 Apr 2024 13:26:27 GMT

Helo

I have a search query like this: index=test dscip=192.168.1.1 OR dscip=192.168.1.2 ...

I would like to search this list of ip based on system-alias in my lookup

This is my sample lookup.csv:

system-alias	system-ip
prod	192.168.1.1
dev	192.168.2.2
prod	192.168.1.2

so what a search query should look like if i want to serach only for prod ip`s ?

Re: Search for ip in lookup based on system alias in csv

renjith_nair — Wed, 24 Apr 2024 13:39:29 GMT

@Trusty
You can use the lookup to enrich the dataset and then filter based on the value

Re: Search for ip in lookup based on system alias in csv

Trusty — Thu, 25 Apr 2024 07:28:58 GMT

It works, I have an IP list based on the specified system name (prod etc). Now how can I associate this list with a search?
So that the list of IPs displayed by this query can be attached to dscip
| search sourcetype="new" DstIP=(list of above ip)