Splunk Search

How to compare a search field value with a field value in a lookup ?

mah
Contributor

Hi,

My issue is : 

I have a query which contains a "NetworkIterface" field: eni-12345, eni-6789, ...
I have a lookup which contains the list of network interfaces whose ip are public:
I want to be able to create a request which, by combining the search and the lookup, only shows the network interface whose ip are public only.

I have a lookup like that :

ENIPublic IP
eni-1234192.10.10.10
eni-5678192.10.10.11
eni-9012192.10.10.12

 

My search is basic : 

Index=abc sourcetype=xyz NetworkInterface=* 

Thanks for your help !

0 Karma
1 Solution

rnowitzki
Builder

Hi @mah ,

This should work:

| makeresults 
| eval ENI = "eni-1234 eni-9012 eni-9013 eni-9015" 
| makemv ENI
| mvexpand ENI

| lookup pubip.csv "ENI"  OUTPUT "Public IP" as IP
| where IP!=""



You only need the lines starting with the lookup command. The ones above that are just to create some sample data.

Sidenote: I recommend to output your "Public IP" field as "IP" (or maybe "PublicIP"), because spaces in field names cause issues. I could not get the "where" command to work correct with "Public IP" as fieldname...

Hope it helps.

BR
Ralph
--
Karma and/or Solution tagging appreciated.

--
Karma and/or Solution tagging appreciated.

View solution in original post

rnowitzki
Builder

Hi @mah ,

This should work:

| makeresults 
| eval ENI = "eni-1234 eni-9012 eni-9013 eni-9015" 
| makemv ENI
| mvexpand ENI

| lookup pubip.csv "ENI"  OUTPUT "Public IP" as IP
| where IP!=""



You only need the lines starting with the lookup command. The ones above that are just to create some sample data.

Sidenote: I recommend to output your "Public IP" field as "IP" (or maybe "PublicIP"), because spaces in field names cause issues. I could not get the "where" command to work correct with "Public IP" as fieldname...

Hope it helps.

BR
Ralph
--
Karma and/or Solution tagging appreciated.

--
Karma and/or Solution tagging appreciated.

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!