topic Re: How do you replace ip address with name? in Getting Data In

How do you replace ip address with name?

papalmi — Tue, 21 Jul 2015 16:03:27 GMT

We're looking to substitute the host field, which is an IP address, with the device name that corresponds to the IP address. I'm trying to do this using a .csv file and have the output automatically changed. I've resolved all the errors but I haven't been successful yet. Help would be appreciated. Thanks

Re: How do you replace ip address with name?

martin_mueller — Tue, 21 Jul 2015 16:05:31 GMT

If you have a .csv like this

ip,device
1.2.3.4,foo

then you can define that as a lookup table, and specify an automatic lookup for your sourcetype using ip as the input field and device as the output field - with potentially some renaming if the field isn't called ip in your data. Then Splunk will automagically add a device field to your events.

Re: How do you replace ip address with name?

papalmi — Tue, 21 Jul 2015 16:13:24 GMT

Hi Martin, thanks for the quick replay. Perhaps it's the input/output fields where the issue lies. The .csv file has 2 columns, clientip and clienthost. I'm trying to get the contents of clienthost (which is the device name) to replace the search output field host (which is the ip address). This is what's configured under Lookups> Automatic lookups>

Lookup input fields
clientip = host

Lookup output fields
clienthost = host

Thanks

Re: How do you replace ip address with name?

martin_mueller — Tue, 21 Jul 2015 16:53:42 GMT

Did you check the box to overwrite field values?

Note, you may not be able to output to the same field name as your input.

Re: How do you replace ip address with name?

papalmi — Tue, 21 Jul 2015 17:08:27 GMT

Yes, overwrite is checked. I'll try different field names and see what happens.

Thanks

Re: How do you replace ip address with name?

papalmi — Tue, 21 Jul 2015 18:40:14 GMT

note that |inputlookup .csv does output the contents of the .csv file correctly