topic Re: How to lookup in Splunk? in Splunk Search

How to lookup in Splunk?

SharmaS2 — Tue, 22 Feb 2022 17:17:41 GMT

Hi Team,

i have one abc.csv file with only one colunm as Source_IP where values are in10.10.10.0/24 format .

next i have index=xyz which has multiple column as dst,city,counrty , src is one of the column .

here i need all data from index=xyz where Source_IP from abc.csv matches with src column of index=xyz.

i have uploaded the file successfully but unable to find the relevant query to fetch data ..

Re: How to lookup in Splunk?

Stefanie — Tue, 22 Feb 2022 18:49:15 GMT

Try something like this:

index=xyz [|inputlookup abc.csv |rename "Source_IP" as "src"|return 999 "src"]

After the search, add a pipe (|) and the rest of your search criteria.

Re: How to lookup in Splunk?

SanjayReddy — Wed, 23 Feb 2022 04:42:27 GMT

Re: How to lookup in Splunk?

SharmaS2 — Wed, 23 Feb 2022 10:54:34 GMT

thanks ..its working properly ..

can you please explain what is

return 999

Re: How to lookup in Splunk?

Stefanie — Wed, 23 Feb 2022 13:29:39 GMT

Sure!

The return command returns values from the subsearch (The stuff in your brackets) so that you can use it to compare with your main search. But the return command automatically limits the number of items returned, you have to tell it how many to return.
Because I don't know how big your csv is, 999 was a safe bet. 🙂