Splunk Search

How to write a search to output results where a field from my events match with a field in my lookup CSV file?

geantver0000
Engager

Hi,

I have found many searches using lookup files, but none works correctly for me What is the correct search to get this?:

My event :
Date, URL, IP

My lookup CSV file:
City, Street, SubnetIP

I want to match the IP on my event with the SubnetIP of my CSV file to get this result

Result :
Date, URL, IP ( it matches witch SubnetIP), CITY

Kind regards

Steve

0 Karma
1 Solution

splunkton
Path Finder

base search [|inputlookup lookup.csv|rename SubnetIP AS IP|table IP] --> it returns the results matching with the event and the lookup table

to derive city from the lookup table |lookup lookup.csv SubnetIP AS IP OUTPUT CITY

The total search query is going to be

base search [|inputlookup lookup.csv|rename SubnetIP AS IP|table IP]||lookup lookup.csv SubnetIP AS IP OUTPUT CITY | table Date URL IP City

View solution in original post

splunkton
Path Finder

base search [|inputlookup lookup.csv|rename SubnetIP AS IP|table IP] --> it returns the results matching with the event and the lookup table

to derive city from the lookup table |lookup lookup.csv SubnetIP AS IP OUTPUT CITY

The total search query is going to be

base search [|inputlookup lookup.csv|rename SubnetIP AS IP|table IP]||lookup lookup.csv SubnetIP AS IP OUTPUT CITY | table Date URL IP City

geantver0000
Engager

Indeed this search seems to works !
Really usefull thanks

Steve

0 Karma

sundareshr
Legend

Try this

... | lookup lokupfile.csv SubnetIP as IP OUTPUT City | table Date URL IP City
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...