https://community.splunk.com/t5/Splunk-Search/Lookup-based-on-if-statement/m-p/448401#M127044 <P>Like this:</P> <PRE><CODE>... | lookup myacmelookup.csv IP AS TID | eval TID=coalesce(HOST, TID) | fields - HOST </CODE></PRE> Thu, 15 Aug 2019 22:37:37 GMT woodcock 2019-08-15T22:37:37Z https://community.splunk.com/t5/Splunk-Search/Lookup-based-on-if-statement/m-p/448400#M127043 <P>I am looking to enhance a search with a lookup (if it returns an IP) to replace the value returned in the TID field if it matches an IP instead of a DNS name. </P> <P>I am experimenting with the following but not sure how to do the lookup correctly if the if statement returns a "yes" (or if using eval is even the best method)</P> <P>| eval TID=if(cidrmatch("10.0.0.0/8", ), , TID)</P> <P>Ex:<BR /> TID: myhostname.acmerocket.com (Do nothing)</P> <P>TID: 10.100.0.1 (Replace with hostname from myacmelookup.csv)</P> <P>Examples of possible fields in myacmelookup.csv</P> <P>IP: 10.100.0.1<BR /><BR /> HOST: coyote.acmerocket.com</P> <P>IP: 10.100.0.2<BR /> HOST: myhostname.acmerocket.com</P> Thu, 15 Aug 2019 21:58:32 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-based-on-if-statement/m-p/448400#M127043 donemery 2019-08-15T21:58:32Z https://community.splunk.com/t5/Splunk-Search/Lookup-based-on-if-statement/m-p/448401#M127044 <P>Like this:</P> <PRE><CODE>... | lookup myacmelookup.csv IP AS TID | eval TID=coalesce(HOST, TID) | fields - HOST </CODE></PRE> Thu, 15 Aug 2019 22:37:37 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-based-on-if-statement/m-p/448401#M127044 woodcock 2019-08-15T22:37:37Z https://community.splunk.com/t5/Splunk-Search/Lookup-based-on-if-statement/m-p/448402#M127045 <P>Thanks for your help!</P> Wed, 21 Aug 2019 16:56:03 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-based-on-if-statement/m-p/448402#M127045 donemery 2019-08-21T16:56:03Z