Splunk Search

How to use a lookup file to search for ip addresses in my logs?

jcaron9999a
Explorer

I have a lookup file called ipaddress.csv.  The column title in the file is ipaddress.  I want to search my logs for all of these ip addresses.  I know I need to use inputlookup to get the addresses from the file, but I can't figure out how to then feed them to a search.

 

Thanks in advance

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

This is a subsearch, where the inputlookup is used as a subsearch

your_base_search [ | inputlookup ipaddress.csv | fields ipaddress ]

Here the subsearch ([] section) runs first and returns a structured piece of text with 

ipaddress=A OR ipaddress=B OR ipaddress=C

and so on to the outer search. Note that if your ip address field in your main index search is something different, then before the fields command, you should do a rename

| rename ipaddress as your_ip_field

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

This is a subsearch, where the inputlookup is used as a subsearch

your_base_search [ | inputlookup ipaddress.csv | fields ipaddress ]

Here the subsearch ([] section) runs first and returns a structured piece of text with 

ipaddress=A OR ipaddress=B OR ipaddress=C

and so on to the outer search. Note that if your ip address field in your main index search is something different, then before the fields command, you should do a rename

| rename ipaddress as your_ip_field

 

jcaron9999a
Explorer

Thanks!  That did the trick.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...