topic Re: request lookup in Splunk Search

Help with lookup to get table?

simo — Wed, 23 Nov 2022 04:07:45 GMT

Hi,

I have a lookup as follow

ip	id	name
111.111.111.111	111	simone
*	222	marco

in the index I have

ip	id
111.111.111.111	111
222.222.222.222	222
333.333.333.333	222

the result I'm looking for is the following

ip	id	name
111.111.111.111	111	simone
222.222.222.222	222	marco
333.333.333.333	222	marco

can help me?

thank you

Simone

Re: request lookup

richgalloway — Tue, 22 Nov 2022 21:46:20 GMT

It would help to know what you've tried so far and why it didn't work for you. Also, it's not clear what the key is in the lookup file. Both ip and id appear to be the key, but only id is unique (at least in the example).

Did you try this?

| lookup mylookup.csv id OUTPUT name

If the asterisk in the ip column is intended as a wildcard then a standard lookup won't work because it treats the "*" literally. The workaround is to create a lookup definition and add a wildcard field.

Go to Settings->Lookups->Lookup definition and click on New Lookup Definition. Fill in the form to point to your lookup file then check the "Advanced options" box. In the "Match type" box enter WILDCARD(ip) and click Save. Then the command becomes

| lookup mylookup ip id OUTPUT name

Re: request lookup

simo — Wed, 23 Nov 2022 08:27:58 GMT

@richgalloway thanks thats what i was looking for! 🙂