topic Re: Best way to search using a lookup table? in Splunk Search

Best way to search using a lookup table?

Jason — Tue, 05 Oct 2010 23:48:35 GMT

I'm running a search across a bunch of data, say web logs, that has a lot of different src_ips.

I make a lookup of a handful of src_ips that I want to take a look at:

lookup table [iptable]

src_ip
1.2.3.4
1.2.3.5
1.2.4.6

What is the best way to search across all of my data (sourcetype=web, for instance) and ONLY show items matching my lookup file?

Re: Best way to search using a lookup table?

Jason — Tue, 05 Oct 2010 23:50:31 GMT

sourcetype=web | join src_ip [inputlookup iptable] ?

Re: Best way to search using a lookup table?

gkanapathy — Wed, 06 Oct 2010 00:01:32 GMT

Assuming there is a field in your data called src_ip, and that you have (say) millions of events and less than a few hundred entries in your lookup table, the most efficient way is probably:

sourcetype=web [ inputlookup iptable | fields src_ip ]

If the field in the sourcetype is called, say, source_address, you could do:

sourcetype=web [ inputlookup iptable | fields src_ip | rename src_ip as souce_address ]