How to lookup in Splunk?

[SharmaS2]

Hi Team,

i have one abc.csv file with  only one colunm as Source_IP where values are in10.10.10.0/24 format .

next i have  index=xyz which has multiple column as dst,city,counrty , src is one of the  column .

here i need all data from index=xyz where Source_IP from abc.csv matches with src column of index=xyz.

i have uploaded the file successfully but unable to find the relevant query to fetch data ..

[SanjayReddy]

Hi @SharmaS2 

Can you try this 

index=xyz
| lookup abc.csv Source_IP as src  
| table src,dst,city,counrty

OR 

index=xyz
| join type=left src
[| lookup abc.csv Source_IP as src
| fields src]

| table src,dst,city,counrty

[Stefanie · Accepted solution]

Try something like this:

index=xyz [|inputlookup abc.csv |rename "Source_IP" as "src"|return 999 "src"] 

After the search, add a pipe (|) and the rest of your search criteria. 

[SharmaS2]

thanks ..its working properly ..

can you please explain what is 

return 999

[Stefanie]

Sure!

The return command returns values from the subsearch (The stuff in your brackets) so that you can use it to compare with your main search. But the return command automatically limits the number of items returned, you have to tell it how many to return. 
Because I don't know how big your csv is, 999 was a safe bet. 🙂