Splunk Search

Automatic Lookup not working

Explorer

CSV file
Source_IP,Source_Name
18.130.101.34,AWS
18.130.215.107,AWS

or

Source_IP,Source_Name
"18.130.101.34",AWS
"18.130.215.107",AWS

Transforms.conf
[network_whitlist_def]
batch_index_query = 0
case_sensitive_match = 1
filename = network_whitelist.csv
fields_list = Source_IP, Source_Name

Props.conf
[OktaIM2:log]
LOOKUP-network_whitelist = network_whitlist_def Source_IP AS x OUTPUTNEW Source_Name

sourcetype=OktaIM2:log client.ipAddress="18.130.101.34" | spath path=client{}.ipAddress output=x | lookup network_whitelist.csv Source_IP AS x OUTPUTNEW Source_Name AS whitelist

The manual lookup works fine and adds a new field called whitelist
However, sourcetype=OktaIM2:log client.ipAddress="18.130.101.34" | spath path=client{}.ipAddress output=x does not work, (Splunk version 7.2) Any clues would be appreciated

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!