How to compare a search field value with a field value in a lookup ?

[mah]

Hi,

My issue is : 

I have a query which contains a "NetworkIterface" field: eni-12345, eni-6789, ...
I have a lookup which contains the list of network interfaces whose ip are public:
I want to be able to create a request which, by combining the search and the lookup, only shows the network interface whose ip are public only.

I have a lookup like that :

ENI	Public IP
eni-1234	192.10.10.10
eni-5678	192.10.10.11
eni-9012	192.10.10.12

My search is basic : 

Index=abc sourcetype=xyz NetworkInterface=* 

Thanks for your help !

[rnowitzki · Accepted solution]

Hi @mah ,

This should work:

| makeresults 
| eval ENI = "eni-1234 eni-9012 eni-9013 eni-9015" 
| makemv ENI
| mvexpand ENI

| lookup pubip.csv "ENI"  OUTPUT "Public IP" as IP
| where IP!=""

You only need the lines starting with the lookup command. The ones above that are just to create some sample data.

Sidenote: I recommend to output your "Public IP" field as "IP" (or maybe "PublicIP"), because spaces in field names cause issues. I could not get the "where" command to work correct with "Public IP" as fieldname...

Hope it helps.

BR
Ralph
--
Karma and/or Solution tagging appreciated.