Splunk Search

Help with lookup to get table?

simo
Path Finder

Hi,

I have a lookup as follow

ip id name
111.111.111.111 111 simone
* 222 marco

in the index I have 

ip id 
111.111.111.111 111
222.222.222.222 222
333.333.333.333 222

 

the result I'm looking for is the following

ip id  name
111.111.111.111 111 simone
222.222.222.222 222 marco
333.333.333.333 222 marco

 

can help me?

thank you

Simone

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried so far and why it didn't work for you.  Also, it's not clear what the key is in the lookup file.  Both ip and id appear to be the key, but only id is unique (at least in the example).

Did you try this?

| lookup mylookup.csv id OUTPUT name

If the asterisk in the ip column is intended as a wildcard then a standard lookup won't work because it treats the "*" literally.  The workaround is to create a lookup definition and add a wildcard field.

Go to Settings->Lookups->Lookup definition and click on New Lookup Definition.  Fill in the form to point to your lookup file then check the "Advanced options" box. In the "Match type" box enter WILDCARD(ip) and click Save.  Then the command becomes

| lookup mylookup ip id OUTPUT name

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried so far and why it didn't work for you.  Also, it's not clear what the key is in the lookup file.  Both ip and id appear to be the key, but only id is unique (at least in the example).

Did you try this?

| lookup mylookup.csv id OUTPUT name

If the asterisk in the ip column is intended as a wildcard then a standard lookup won't work because it treats the "*" literally.  The workaround is to create a lookup definition and add a wildcard field.

Go to Settings->Lookups->Lookup definition and click on New Lookup Definition.  Fill in the form to point to your lookup file then check the "Advanced options" box. In the "Match type" box enter WILDCARD(ip) and click Save.  Then the command becomes

| lookup mylookup ip id OUTPUT name

 

---
If this reply helps you, Karma would be appreciated.

simo
Path Finder

@richgalloway thanks thats what i was looking for! 🙂

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...