https://community.splunk.com/t5/Splunk-Search/Trying-to-map-IP-address-from-lookup-table-in-search/m-p/481031#M134790 <P>Hi,</P> <P>I am trying to map the ip address in my search to my lookup table, and it should return me the countries of the IP address.</P> <P>Sample lookup table </P> <P>country ip_address<BR /> Italy 2.123.123.9/24, 2.124.124.9/11</P> <P>Problem is, in my events, my IP address is 2.123.123.1.</P> <P>I want to search the ip_address in the lookup table perhaps for 2.123.123 and return me Italy ?</P> <P>This is my search query </P> <PRE><CODE>index=ip_address "status=200" ip_address | lookup ip_mapping.csv ip_address outputnew u_country as country </CODE></PRE> <P>The search executed successfully, but there is no country being returned. What am i missing ? </P> Thu, 09 Jan 2020 11:00:35 GMT wailoont 2020-01-09T11:00:35Z https://community.splunk.com/t5/Splunk-Search/Trying-to-map-IP-address-from-lookup-table-in-search/m-p/481031#M134790 <P>Hi,</P> <P>I am trying to map the ip address in my search to my lookup table, and it should return me the countries of the IP address.</P> <P>Sample lookup table </P> <P>country ip_address<BR /> Italy 2.123.123.9/24, 2.124.124.9/11</P> <P>Problem is, in my events, my IP address is 2.123.123.1.</P> <P>I want to search the ip_address in the lookup table perhaps for 2.123.123 and return me Italy ?</P> <P>This is my search query </P> <PRE><CODE>index=ip_address "status=200" ip_address | lookup ip_mapping.csv ip_address outputnew u_country as country </CODE></PRE> <P>The search executed successfully, but there is no country being returned. What am i missing ? </P> Thu, 09 Jan 2020 11:00:35 GMT https://community.splunk.com/t5/Splunk-Search/Trying-to-map-IP-address-from-lookup-table-in-search/m-p/481031#M134790 wailoont 2020-01-09T11:00:35Z https://community.splunk.com/t5/Splunk-Search/Trying-to-map-IP-address-from-lookup-table-in-search/m-p/481032#M134791 <P>assuming your lookup has field name as <CODE>country</CODE> and <CODE>ip_address</CODE>then try below search-</P> <PRE><CODE> index=ip_address "status=200" ip_address | lookup ip_mapping.csv ip_address OUTPUT country as Country </CODE></PRE> <P>After OUTPUT you need to specify lookup fieldname</P> Thu, 09 Jan 2020 11:05:55 GMT https://community.splunk.com/t5/Splunk-Search/Trying-to-map-IP-address-from-lookup-table-in-search/m-p/481032#M134791 493669 2020-01-09T11:05:55Z https://community.splunk.com/t5/Splunk-Search/Trying-to-map-IP-address-from-lookup-table-in-search/m-p/481033#M134792 <P><A href="http://grumblesoft.com/2019/02/07/splunk-lookups-with-cidr-matching/">splunk-lookups-with-cidr-matching</A></P> <P>Is the setting OK?</P> Thu, 09 Jan 2020 11:32:41 GMT https://community.splunk.com/t5/Splunk-Search/Trying-to-map-IP-address-from-lookup-table-in-search/m-p/481033#M134792 to4kawa 2020-01-09T11:32:41Z https://community.splunk.com/t5/Splunk-Search/Trying-to-map-IP-address-from-lookup-table-in-search/m-p/481034#M134793 <P>You need to do several things.<BR /> 1. configure a lookup definition which cidrmatching<BR /> 2. reference the lookup definition name in the lookup command NOT the filename.csv. When you reference the file directly you bypass the lookup definition features and break your cidrmatching</P> <P>Optional<BR /> 1. Why are you using a custom table instead of updating the geolocation database and using the iplocation command?</P> <UL> <LI><A href="https://github.com/georgestarcher/TA-geoip">https://github.com/georgestarcher/TA-geoip</A></LI> <LI><A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Iplocation">https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Iplocation</A></LI> </UL> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Iplocation">https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Iplocation</A></P> Thu, 09 Jan 2020 21:49:39 GMT https://community.splunk.com/t5/Splunk-Search/Trying-to-map-IP-address-from-lookup-table-in-search/m-p/481034#M134793 starcher 2020-01-09T21:49:39Z