https://community.splunk.com/t5/Splunk-Search/Creating-a-lookup-from-comma-separated-data/m-p/199293#M57697 <P>I am assuming the sample event your posted is already indexed and when searched, you are able to get fields asset_group_title and scanips. </P> <PRE><CODE>query to select your event | fields asset_group_title, scanips | rename asset_group_title as asset_group, scanips as ip | eval ip=split(ip,",") | mvexpand ip | outputlookup yourlookupfilename </CODE></PRE> Mon, 28 Sep 2020 15:37:37 GMT somesoni2 2020-09-28T15:37:37Z https://community.splunk.com/t5/Splunk-Search/Creating-a-lookup-from-comma-separated-data/m-p/199292#M57696 <P>I'm trying to do some work with qualys data. There are events that describe "asset groups", with a bunch of fields, one of which is "scanips", which is a comma separated list of IP addresses. something like:</P> <P>asset_group_id=1376498 asset_group_title="San Francisco Assets" scanips=10.10.1.2,10.10.1.3,10.10.5.2</P> <P>I'd like to process that data and use outputlookup to create a lookup table that would be something like</P> <P>ip,asset_group<BR /><BR /> 10.10.1.2,San Francisco Assets<BR /><BR /> 10.10.1.3,San Francisco Assets<BR /><BR /> 10.10.5.2,San Francisco Assets</P> <P>I'd like to do this all within splunk, but can't figure out how. Any thoughts?</P> <P>Thanks<BR /> Steve</P> Mon, 28 Sep 2020 15:37:24 GMT https://community.splunk.com/t5/Splunk-Search/Creating-a-lookup-from-comma-separated-data/m-p/199292#M57696 Steve_Litras 2020-09-28T15:37:24Z https://community.splunk.com/t5/Splunk-Search/Creating-a-lookup-from-comma-separated-data/m-p/199293#M57697 <P>I am assuming the sample event your posted is already indexed and when searched, you are able to get fields asset_group_title and scanips. </P> <PRE><CODE>query to select your event | fields asset_group_title, scanips | rename asset_group_title as asset_group, scanips as ip | eval ip=split(ip,",") | mvexpand ip | outputlookup yourlookupfilename </CODE></PRE> Mon, 28 Sep 2020 15:37:37 GMT https://community.splunk.com/t5/Splunk-Search/Creating-a-lookup-from-comma-separated-data/m-p/199293#M57697 somesoni2 2020-09-28T15:37:37Z