Splunk Search

Help with lookup to get table?

simo
Path Finder

Hi,

I have a lookup as follow

ip id name
111.111.111.111 111 simone
* 222 marco

in the index I have 

ip id 
111.111.111.111 111
222.222.222.222 222
333.333.333.333 222

 

the result I'm looking for is the following

ip id  name
111.111.111.111 111 simone
222.222.222.222 222 marco
333.333.333.333 222 marco

 

can help me?

thank you

Simone

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried so far and why it didn't work for you.  Also, it's not clear what the key is in the lookup file.  Both ip and id appear to be the key, but only id is unique (at least in the example).

Did you try this?

| lookup mylookup.csv id OUTPUT name

If the asterisk in the ip column is intended as a wildcard then a standard lookup won't work because it treats the "*" literally.  The workaround is to create a lookup definition and add a wildcard field.

Go to Settings->Lookups->Lookup definition and click on New Lookup Definition.  Fill in the form to point to your lookup file then check the "Advanced options" box. In the "Match type" box enter WILDCARD(ip) and click Save.  Then the command becomes

| lookup mylookup ip id OUTPUT name

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried so far and why it didn't work for you.  Also, it's not clear what the key is in the lookup file.  Both ip and id appear to be the key, but only id is unique (at least in the example).

Did you try this?

| lookup mylookup.csv id OUTPUT name

If the asterisk in the ip column is intended as a wildcard then a standard lookup won't work because it treats the "*" literally.  The workaround is to create a lookup definition and add a wildcard field.

Go to Settings->Lookups->Lookup definition and click on New Lookup Definition.  Fill in the form to point to your lookup file then check the "Advanced options" box. In the "Match type" box enter WILDCARD(ip) and click Save.  Then the command becomes

| lookup mylookup ip id OUTPUT name

 

---
If this reply helps you, Karma would be appreciated.

simo
Path Finder

@richgalloway thanks thats what i was looking for! 🙂

0 Karma
Get Updates on the Splunk Community!

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...