Need some help. I can't wrap my head around this.
Need to lookup a csv which contains clientip, and compare against my results with IP also in field clientip to show in a new column as matching or not matching
| index=foo ....
[|inputlookup IPlist.csv | fields clientip | rename clientip AS knownIP]
| eval isMatching = if(clientip == knownIP, "matching", "notmatch")
| table clientip, field x, field y, field z, isMatching
Am I way off base here? Should I be looking at other commands? I get zero results with this. Without it, my main search runs fine and many events with IPs show.
Much appreciated
I am not entirely sure what you are trying to do here
Assuming index foo has a field called clientip and the csv file also has a field called clientip, you can filter your search so that only events from foo with matching ips are kept
index=foo ... [|inputlookup IPlist.csv | fields clientip]
| table clientip, field x, field y, field z
If you want to keep all events from foo but mark those event with matching client ip, you need to have a field from your csv which is not present in foo, or create one - try something like this
index=foo ...
| lookup IPlist.csv OUTPUT clientip AS knownIP
| eval isMatching = if(isnotnul(knownIP), "matching", "notmatch")
| table clientip, field x, field y, field z, isMatching
Thank you for your help. Makes sense and should've been easy enough looking now at the answer. But spent hours myself. Much appreciated!
I am not entirely sure what you are trying to do here
Assuming index foo has a field called clientip and the csv file also has a field called clientip, you can filter your search so that only events from foo with matching ips are kept
index=foo ... [|inputlookup IPlist.csv | fields clientip]
| table clientip, field x, field y, field z
If you want to keep all events from foo but mark those event with matching client ip, you need to have a field from your csv which is not present in foo, or create one - try something like this
index=foo ...
| lookup IPlist.csv OUTPUT clientip AS knownIP
| eval isMatching = if(isnotnul(knownIP), "matching", "notmatch")
| table clientip, field x, field y, field z, isMatching