Splunk Search

How to build a lookup table based on a condition?

dgoamaral
Engager

Hello all,

I can't figure out how to build a lookup with a condition. I have the following table which is my base search:

SubnetName     ip_address
Subnet_ABCD   10.177.99.53
Subnet_1234     10.8.183.3
Subnet_1234     10.8.182.233
Subnet_ABCD    10.177.83.244

And the following lookup table:

Last_SubnetName SubnetID    NetStart    NetEnd
Subnet_A    10.177.0.0/16   10.177.0.1  10.177.255.254
Subnet_B    10.8.0.0/16 10.8.0.1    10.8.255.254
Subnet_B    192.16.0.0/24   192.168.0.1 192.168.0.254

This is the closest I got after reading several articles, but as you can see, I got no luck. The result is simply blank every time I try it.

index=mybasesearch  ( [| inputlookup myLookupTable.csv | table Last_SubnetName,SubnetID,NetStart,NetEnd ]  AND last_ip_address
>=NetStart AND last_ip_address<=NetEnd)

Need your help to proceed.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What results are you trying to get?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...