https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-create-a-data-model-lookup-attribute-that-is/m-p/359271#M106221 <P>Lookups are defined in transforms.conf. This is an example of the configuration that you need.</P> <P><STRONG>transforms.conf</STRONG></P> <PRE><CODE>[mylookup] filename = ../lookups/thefilename.csv max_matches = 1 min_matches = 1 default_match = Unknown match_type = CIDR </CODE></PRE> <P>And the search could be</P> <PRE><CODE>yoursearchhere | lookup mylookup dest_IP as cidr OUTPUT environment as destination_environment | lookup mylookup source_IP as cidr OUTPUT environment as source_environment </CODE></PRE> <P>HTH!</P> Thu, 16 Mar 2017 23:33:59 GMT lguinn2 2017-03-16T23:33:59Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-create-a-data-model-lookup-attribute-that-is/m-p/359270#M106220 <P>Is it possible to create a data model lookup attribute that is based on a CSV file that contains a name column and a CIDR column?</P> <P>Example file</P> <P>environment, cidr<BR /> foo, 123.123.123/24<BR /> bar, 321.321.321/24</P> <P>So I can match a source IP or a destination IP against the CIDR to get the "environment" name? Creating two fields like source_environment and destination_environment</P> Tue, 29 Sep 2020 13:15:47 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-create-a-data-model-lookup-attribute-that-is/m-p/359270#M106220 yacht_rock 2020-09-29T13:15:47Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-create-a-data-model-lookup-attribute-that-is/m-p/359271#M106221 <P>Lookups are defined in transforms.conf. This is an example of the configuration that you need.</P> <P><STRONG>transforms.conf</STRONG></P> <PRE><CODE>[mylookup] filename = ../lookups/thefilename.csv max_matches = 1 min_matches = 1 default_match = Unknown match_type = CIDR </CODE></PRE> <P>And the search could be</P> <PRE><CODE>yoursearchhere | lookup mylookup dest_IP as cidr OUTPUT environment as destination_environment | lookup mylookup source_IP as cidr OUTPUT environment as source_environment </CODE></PRE> <P>HTH!</P> Thu, 16 Mar 2017 23:33:59 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-create-a-data-model-lookup-attribute-that-is/m-p/359271#M106221 lguinn2 2017-03-16T23:33:59Z