Splunk Search

Creating a lookup from comma separated data...

Path Finder

I'm trying to do some work with qualys data. There are events that describe "asset groups", with a bunch of fields, one of which is "scanips", which is a comma separated list of IP addresses. something like:

asset_group_id=1376498 asset_group_title="San Francisco Assets" scanips=,,

I'd like to process that data and use outputlookup to create a lookup table that would be something like

ip,asset_group,San Francisco Assets,San Francisco Assets,San Francisco Assets

I'd like to do this all within splunk, but can't figure out how. Any thoughts?


Tags (2)
0 Karma


I am assuming the sample event your posted is already indexed and when searched, you are able to get fields asset_group_title and scanips.

query to select your event | fields asset_group_title, scanips | rename asset_group_title as asset_group, scanips as ip | eval ip=split(ip,",") | mvexpand ip | outputlookup yourlookupfilename