topic Re: If I have an IP address from a search, how do I look for its hostname from a lookup table? in Splunk Search

If I have an IP address from a search, how do I look for its hostname from a lookup table?

np_hwp — Fri, 04 Feb 2022 14:41:08 GMT

Hello experts,

If I have only IP address of hosts from a search, how do I look for its hostname from a lookup table?

Let say, I search, index=network_device.

I have a lookup table that contains IP address and host names of all assets.

Re: If I have an IP address from a search, how do I look for its hostname from a lookup table?

richgalloway — Fri, 04 Feb 2022 14:50:10 GMT

Let's assume the network_device index contains a field called ip_address that holds the IP address of a host. Let's also assume you have a lookup table called hostnames.csv with two fields: ip_address and hostname.

To get a host name from an IP address, a query might look something like this.

index=network_device ip_address=* | lookup hostnames.csv ip_address OUTPUT hostname | table ip_address hostname

Re: If I have an IP address from a search, how do I look for its hostname from a lookup table?

gcusello — Fri, 04 Feb 2022 14:51:24 GMT

Hi @np_hwp,

if the field in your lookup are called ip and hostname and the field in the search is called ip, you could run something like this:

index=network_device | lookup your_lookup.csv ip OUTPUT hostname | table ip hostname

For more infos see the lookup command https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Lookup

Ciao.

Giuseppe

Re: If I have an IP address from a search, how do I look for its hostname from a lookup table?

gcusello — Sat, 05 Feb 2022 07:25:36 GMT

Hi @np_hwp,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉