topic Re: Query help lookup in Splunk Search

Query help lookup

surekhasplunk — Wed, 01 Apr 2020 04:35:38 GMT

Hi,

I am using below query to get a match by SUBNET from B.csv and get the IP filed.
And show all fields from A.csv with the matching SUBNET from b.csv and get the IP field.

| inputlookup A.csv |bla blal | where arp_usage_percentage>60 | rename subnet_global as SUBNET |lookup B.csv SUBNET output IP

But now i am facing issue where all the IPs are not show in my result. Only 100 records are coming whereas there are more than that.

Why i am getting only 100 results and is there any other way to show.

Re: Query help lookup

manjunathmeti — Wed, 01 Apr 2020 06:43:14 GMT

You are using OUTPUT clause which makes the output lookup fields overwrite existing fields in the events. You can use below query to preserve IP field:

| inputlookup A.csv |bla blal | where arp_usage_percentage>60 | rename subnet_global as SUBNET | lookup B.csv SUBNET OUTPUT IP AS MATCHED_IP

Re: Query help lookup

surekhasplunk — Wed, 01 Apr 2020 08:45:02 GMT

Hi @manjunathmeti ,

Thanks for the reply but looks its the same even if i use IP as MATCHED_IP
Note: there is no IP field in A.csv file. So overwriting cant be the issue from my point of view.
there is something which just limits and so we are getting only 100 IPs for each of the SUBNET