topic Re: Splunk inputlookup comparison and rex in Splunk Search

Splunk inputlookup comparison and rex

sbondred — Sat, 12 Aug 2023 03:20:18 GMT

I have 2 lookup files as

lookup1.csv and
lookup2.csv

lookup1.csv has the data as below

name, designation, server, ipaddress, dept
tim, ceo, hostname.com, 1.2.3.5, alldept
jim, vp, myhost.com, 1.0.3.5, marketing
pim, staff, nohost.com, 4.0.4.8, hr

lookup2.csv has the data as below

cidr, location
1.2.3.0/24, dc
1.0.3.0/24, carolina
3.4.7.0/24, tx

I would like to lookup for the field ipaddress in lookup1.csv with the field cidr in lookup2.csv for the first 3 digits as in x.x.x and get the location field if they match. If the ipaddress doesn't match the first 3 digit of cidr , the location should be marked as "unknown".

Expected o/p

tim, ceo,1.2.4.5, dc
jim, vp, 1.0.3.5, carolina
pim, staff, 4.0.4.8, unkown

I am looking for the search command in splunk using the 2 lookup tables. Thanks in advance. My search so far has not yield any good results but I am still working on it.

Re: Splunk inputlookup comparison and rex

gcusello — Sat, 12 Aug 2023 05:51:08 GMT

Hi @sbondred,

you have to configure your second lookup to match cidr:

go in [Settings > Lookup Definitions]
flag on Advanced options
put CIDR in the Match Type option
save

and the run a simple search like the following:

| inputlookup lookup1.csv | lookup lookup2.csv cidr AS ipaddress OUTPUT location | table name designation server ipaddress dept location

Ciao.

Giuseppe

Re: Splunk inputlookup comparison and rex

sbondred — Sat, 12 Aug 2023 13:04:29 GMT

Thanks @gcusello.

I setup the lookup definition to match type as CIDR(cidr) as that is the field name in the file and used the same search as mentioned below. For some reason, it does't provide me the location. It seems like it is not able to lookup for some reason. Still troubleshooting.

Re: Splunk inputlookup comparison and rex

sbondred — Sat, 12 Aug 2023 13:53:01 GMT

Actually, it was my lookuptable name I was using wrong. Its working. Thanks again @gcusello.

Re: Splunk inputlookup comparison and rex

gcusello — Sun, 13 Aug 2023 05:23:46 GMT

Hi @sbondred ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉