https://community.splunk.com/t5/Splunk-Search/Splunk-Lookup-overide/m-p/432995#M123699 <P>Have you tried adding "10.228.80.50 laptop" to the lookup file before the "10.228.80.0/24" entry? The first match in the file should prevail.</P> Thu, 12 Jul 2018 12:42:32 GMT richgalloway 2018-07-12T12:42:32Z https://community.splunk.com/t5/Splunk-Search/Splunk-Lookup-overide/m-p/432994#M123698 <P>Hi Team,</P> <P>we have lookup file which is doing enrichment however we have define the lookup using CIDR values of ip address and working well.<BR /> below is lookup file working well<BR /> ip mac nt_host dns owner priority lat long city country bunit category<BR /> 10.228.80.0/24 is category as workstation </P> <P>now we have ip 10.228.80.50 which we need to categorized as laptop , how we can do that , right now everything is coming as workstation </P> Thu, 12 Jul 2018 06:06:52 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Lookup-overide/m-p/432994#M123698 sumitkathpal 2018-07-12T06:06:52Z https://community.splunk.com/t5/Splunk-Search/Splunk-Lookup-overide/m-p/432995#M123699 <P>Have you tried adding "10.228.80.50 laptop" to the lookup file before the "10.228.80.0/24" entry? The first match in the file should prevail.</P> Thu, 12 Jul 2018 12:42:32 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Lookup-overide/m-p/432995#M123699 richgalloway 2018-07-12T12:42:32Z