Splunk Search

Creating a lookup from comma separated data...

Path Finder

I'm trying to do some work with qualys data. There are events that describe "asset groups", with a bunch of fields, one of which is "scanips", which is a comma separated list of IP addresses. something like:

asset_group_id=1376498 asset_group_title="San Francisco Assets" scanips=,,

I'd like to process that data and use outputlookup to create a lookup table that would be something like

ip,asset_group,San Francisco Assets,San Francisco Assets,San Francisco Assets

I'd like to do this all within splunk, but can't figure out how. Any thoughts?


Tags (2)
0 Karma

Revered Legend

I am assuming the sample event your posted is already indexed and when searched, you are able to get fields asset_group_title and scanips.

query to select your event | fields asset_group_title, scanips | rename asset_group_title as asset_group, scanips as ip | eval ip=split(ip,",") | mvexpand ip | outputlookup yourlookupfilename
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...