Splunk Search

How to write a search to output results where a field from my events match with a field in my lookup CSV file?

Engager

Hi,

I have found many searches using lookup files, but none works correctly for me What is the correct search to get this?:

My event :
Date, URL, IP

My lookup CSV file:
City, Street, SubnetIP

I want to match the IP on my event with the SubnetIP of my CSV file to get this result

Result :
Date, URL, IP ( it matches witch SubnetIP), CITY

Kind regards

Steve

0 Karma
1 Solution

Path Finder

base search [|inputlookup lookup.csv|rename SubnetIP AS IP|table IP] --> it returns the results matching with the event and the lookup table

to derive city from the lookup table |lookup lookup.csv SubnetIP AS IP OUTPUT CITY

The total search query is going to be

base search [|inputlookup lookup.csv|rename SubnetIP AS IP|table IP]||lookup lookup.csv SubnetIP AS IP OUTPUT CITY | table Date URL IP City

View solution in original post

Path Finder

base search [|inputlookup lookup.csv|rename SubnetIP AS IP|table IP] --> it returns the results matching with the event and the lookup table

to derive city from the lookup table |lookup lookup.csv SubnetIP AS IP OUTPUT CITY

The total search query is going to be

base search [|inputlookup lookup.csv|rename SubnetIP AS IP|table IP]||lookup lookup.csv SubnetIP AS IP OUTPUT CITY | table Date URL IP City

View solution in original post

Engager

Indeed this search seems to works !
Really usefull thanks

Steve

0 Karma

Legend

Try this

... | lookup lokupfile.csv SubnetIP as IP OUTPUT City | table Date URL IP City
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!