Splunk Search

Help with lookup to get table?

simo
Path Finder

Hi,

I have a lookup as follow

ip id name
111.111.111.111 111 simone
* 222 marco

in the index I have 

ip id 
111.111.111.111 111
222.222.222.222 222
333.333.333.333 222

 

the result I'm looking for is the following

ip id  name
111.111.111.111 111 simone
222.222.222.222 222 marco
333.333.333.333 222 marco

 

can help me?

thank you

Simone

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried so far and why it didn't work for you.  Also, it's not clear what the key is in the lookup file.  Both ip and id appear to be the key, but only id is unique (at least in the example).

Did you try this?

| lookup mylookup.csv id OUTPUT name

If the asterisk in the ip column is intended as a wildcard then a standard lookup won't work because it treats the "*" literally.  The workaround is to create a lookup definition and add a wildcard field.

Go to Settings->Lookups->Lookup definition and click on New Lookup Definition.  Fill in the form to point to your lookup file then check the "Advanced options" box. In the "Match type" box enter WILDCARD(ip) and click Save.  Then the command becomes

| lookup mylookup ip id OUTPUT name

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried so far and why it didn't work for you.  Also, it's not clear what the key is in the lookup file.  Both ip and id appear to be the key, but only id is unique (at least in the example).

Did you try this?

| lookup mylookup.csv id OUTPUT name

If the asterisk in the ip column is intended as a wildcard then a standard lookup won't work because it treats the "*" literally.  The workaround is to create a lookup definition and add a wildcard field.

Go to Settings->Lookups->Lookup definition and click on New Lookup Definition.  Fill in the form to point to your lookup file then check the "Advanced options" box. In the "Match type" box enter WILDCARD(ip) and click Save.  Then the command becomes

| lookup mylookup ip id OUTPUT name

 

---
If this reply helps you, Karma would be appreciated.

simo
Path Finder

@richgalloway thanks thats what i was looking for! 🙂

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...