Splunk Search

Assets Consolidation - Searching and Comparing fields with multiple IP Addresses



I have this query where I am trying to compare two csv files and have the assets data merged





NameIP AddressesDescriptionOS
abc1.1.1.1blah blahwindows
abc.domain.com1.1.1.1, blahwindows
bcd1.1.1.2, blahwindows
def.domain.com1.1.1.3, blahsuse
xyz blah blahaix


| inputlookup CSV1.csv | lookup CSV2.csv "IP Addresses" as ip | table Name, host, ip, OS, os | fillnull Name value="Not Found"

With this query - for some reason i am not able to correlate assets that have multiple "IP Addresses" in CSV2. How can I ensure that any value in the cell is searched instead of having an exact match?


Thank you

Labels (4)
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...