topic Re: reciprocal entries in next row in Getting Data In

reciprocal entries in next row

dxw350 — Tue, 29 Sep 2020 14:34:35 GMT

I am using lookup commands for data in a csv file and trying to map src_ip to the HOST and the SERVER in different rows. As an example
MY ISSUE: There are always entries for both Host and Server, but if the Server entry is not listed as a separate row in the HOST column I need to add it as a reciprocal row. Is there a way to do that with |lookup HOST as src_ip OUTPUT src_ip dest_zone SERVER |lookup SERVER as src_ip OUTPUT src_ip dest_zone SERVER
Example:
HOST SERVER
192.168..1.1 192.168.2.10
192.168.2.10 192.168.1.1 This pair is good

192.168.1.3 192.168.2.11
Missing reciprocal This row needs the reverse

Re: reciprocal entries in next row

somesoni2 — Fri, 23 Jun 2017 19:00:01 GMT

Is your query like this? (there might be a type in first lookup)

your base search giving field src_ip |lookup HOST as src_ip OUTPUT src_ip dest_zone HOST |lookup SERVER as src_ip OUTPUT src_ip dest_zone SERVER

The example output, is it single rows or two rows?

Re: reciprocal entries in next row

dxw350 — Fri, 23 Jun 2017 19:03:24 GMT

Thanks for the reply. It will be separate rows as entries

Re: reciprocal entries in next row

DalJeanis — Fri, 23 Jun 2017 19:33:45 GMT

I wouldn't spend a minute thinking about this...

| inputlookup SERVER 
| appendpipe [ | eval hold=HOST | eval HOST=SERVER | eval SERVER=hold | fields - hold] 
| dedup HOST SERVER
| outputlookup append=f SERVER

Re: reciprocal entries in next row

dxw350 — Tue, 29 Sep 2020 14:39:19 GMT

hi,

I tried your appendpipe solution and it didn't work. I only have one inputlookup csv called "data_file.csv". How can the following be corrected to work?