CSV file
Source_IP,Source_Name
18.130.101.34,AWS
18.130.215.107,AWS
or
Source_IP,Source_Name
"18.130.101.34",AWS
"18.130.215.107",AWS
Transforms.conf
[network_whitlist_def]
batch_index_query = 0
case_sensitive_match = 1
filename = network_whitelist.csv
fields_list = Source_IP, Source_Name
Props.conf
[OktaIM2:log]
LOOKUP-network_whitelist = network_whitlist_def Source_IP AS x OUTPUTNEW Source_Name
sourcetype=OktaIM2:log client.ipAddress="18.130.101.34" | spath path=client{}.ipAddress output=x | lookup network_whitelist.csv Source_IP AS x OUTPUTNEW Source_Name AS whitelist
The manual lookup works fine and adds a new field called whitelist
However, sourcetype=OktaIM2:log client.ipAddress="18.130.101.34" | spath path=client{}.ipAddress output=x does not work, (Splunk version 7.2) Any clues would be appreciated
