topic Re: lookup has matching multivalue field in Splunk Search

Why does lookup have matching multivalue field?

adent — Tue, 18 Oct 2022 22:10:39 GMT

I am trying to add fields from a lookup table. However, the matching field is a multivalue field. I need to expand the matching field but do not know how to group the lookup command with a multivalue command

lookup file assest.csv:

ip, host

10.10.1.1|10.100.1.1|10.10.200.1, srv1

10.10.1.2|10.100.1.2|10.10.200.2, srv2

original search that returns an IP value | [lookup assets.csv ip OUTPUT host |makemv delim="|" ip]

does not work

Re: lookup has matching multivalue field

ITWhisperer — Tue, 18 Oct 2022 21:01:07 GMT

I am not sure I understand what you are trying to do - if you have a multi-value field in your events and you want to look up these values, you could expand the multi-value field first

| mvexpand ip | lookup assets.csv ip OUTPUT host

Re: lookup has matching multivalue field

johnhuang — Tue, 18 Oct 2022 21:03:14 GMT

You can either 1. migrate your csv lookup into a kvstore which supports multivalues or 2. expand the IP values into its own record and save it to a new lookup.

For 2:

Re: lookup has matching multivalue field

adent — Wed, 19 Oct 2022 00:13:16 GMT

The MV IP is in the lookup table. The original search returns a single IP value. The solution above about creating a new lookup table sounds easiest.