Splunk Search

How to search a query and a lookup file with common columns?

mmercola
New Member

][1]

So, I would like to run my query below(which would return IP Addresses) and match the results to the input file by IP and return the DNS name?

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

See https://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/lookup - in your case something like some search here | lookup StaticDNS.csv IP OUTPUT Hostname

inputlookup is for loading the lookup's content as-is, not for enriching other events.

View solution in original post

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @mmercola

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

See https://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/lookup - in your case something like some search here | lookup StaticDNS.csv IP OUTPUT Hostname

inputlookup is for loading the lookup's content as-is, not for enriching other events.

0 Karma

mmercola
New Member

index="network" sourcetype=aerohive search [| inputlookup StaticDNS.csv

I'm stuck after this point

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...