I need to create a new field called ip_address_location and for each IP address perform an if. So like this:
if ip = "1.1.1." assign "site_abc" in ip_address_location if ip = "1.1.2." assign "site_efg" in ip_address_location
etc.
Any suggestions?
A lookup is the ideal solution to this.
Specifically with a cidr match: See this: https://answers.splunk.com/answers/5916/using-cidr-in-a-lookup-table.html
Unfortunately, I do not have permission to modify configuration files.
If you have permission to upload a lookup csv file, you can do the rest of the process via the UI
Upload CSV https://docs.splunk.com/Documentation/Splunk/8.0.1/Knowledge/Usefieldlookupstoaddinformationtoyourev...
Define Lookup https://docs.splunk.com/Documentation/Splunk/8.0.1/Knowledge/Usefieldlookupstoaddinformationtoyourev... Pay attention to Match type
Match type
