How to sort results in a search by using a lookup table?

[dbturner]

So here is what I want to do. I want to be able to search an index and sort the results via subnet/location contained in a lookup file. I'm am not sure how to do this. I need to be able to sort the results by the ip they return that matches a subnet which is in CIDR in the lookup file and then once the results are in that subnet I will know that location.

I hope that makes sense.

Basic version:
I have an ip list that I do not know who owns what IP. I have a lookup file that contains the subnets in cidr and their locations. I want to sort my results by location based on the IP address in the search using a lookup table.

[maciep · Accepted solution]

Not sure if i'm missing something, but if you already have the lookup and the subnet column is set for cidr match, then i think you can just use lookup to get the location, then sort the results however you want.

<your base search>
| lookup your_lookup_table ip_field_in_table AS ip_field_in_data OUTPUT location_field_in_table AS location 
| sort 0 location

also, not sure if the location is specific to your organization, but if it's just a general location and the ip's are public, you could also try using the iplocation command