topic Re: Splunk search lookup in Splunk Search

Splunk search lookup

Harikiranjammul — Thu, 22 May 2025 12:07:31 GMT

Have a data that returns ip field and values as below.

Ip = 0.0.0.11

Ip= 0.0.0.12

There is a lookup that contains field ipaddress with below values

0.0.0.11

0.0.0.13

If we see above 0.0.0.12 missed in the lookup,

I need a search to return 0.0.0.11(existed in both query result and lookup) and 0.0.0.12 (entries which are not in lookup and update them as ip=0.0.0.0 in result)

Re: Splunk search lookup

richgalloway — Thu, 22 May 2025 12:34:44 GMT

The lookup command will return null values when the target value is not present in the lookup table. It's up to the query to test the returned values and take appropriate action when null is returned.

Re: Splunk search lookup

livehybrid — Thu, 22 May 2025 13:35:19 GMT

Hi @Harikiranjammul

You could use the following SPL to achieve this:

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing