Splunk Search

How do you create a static table for a lookup file?

_smp_
Builder

I have kind of a silly question that I am embarrassed to admit has stumped me for a little while.

I have a small list of server IP addresses and names that I would like to put in a lookup table file. I could easily create this file outside of Splunk, but I would prefer to construct a Splunk search to ensure it is built in a consistent way. So I am trying to construct a search which builds a table of static values and pipes the output to '|outputlookup' generate the lookup file. But I can't seem to find the right syntax to build a simple table with a name and IP column. I've tried various combinations of eval, append, appendpipe and I just can't seem to find the right syntax. The table is very simple:

name,ip
server1,ip1
server2,ip2
server3,ip3
Tags (2)
0 Karma
1 Solution

kmaron
Motivator

This should get you what you want

| makeresults 
| eval name="server1" 
| eval ip="ip1" 
| append 
    [| makeresults 
    | eval name="server2" 
    | eval ip="ip2"] 
| append 
    [| makeresults 
    | eval name="server3" 
    | eval ip="ip3"] 
| fields - _time | outputlookup filename

View solution in original post

kmaron
Motivator

This should get you what you want

| makeresults 
| eval name="server1" 
| eval ip="ip1" 
| append 
    [| makeresults 
    | eval name="server2" 
    | eval ip="ip2"] 
| append 
    [| makeresults 
    | eval name="server3" 
    | eval ip="ip3"] 
| fields - _time | outputlookup filename

_smp_
Builder

sigh

That's why I was embarrassed. I knew it would be simple. Thanks!!

0 Karma

kmaron
Motivator

eh no need to be embarrassed. I wasn't sure I remembered how to do it 🙂

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...