Getting Data In

How to find matching and un-matching field values between an index and lookup file?

russell120
Communicator

Hi,

I have a CSV ( current_assets.csv) with fields device_name and ip (and tons of values for them). Here is an example:

device_name        ip
  router1     122.145.11.2
  laptop2     11.121.44.55

How do I search my index ( sourcetype="device_assets") for the CSV IPs and return whether or not each IP is found within the index?

An example result would be:

device_name        ip        found
  router1     122.145.11.2    Yes
  laptop2     11.121.44.55    No

Important note: The solution CANNOT use |join command because this is very intensive/slow for my current deployment.

Thanks

0 Karma
Get Updates on the Splunk Community!

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...