Splunk Search

How to write a search to output results where a field from my events match with a field in my lookup CSV file?

Engager

Hi,

I have found many searches using lookup files, but none works correctly for me What is the correct search to get this?:

My event :
Date, URL, IP

My lookup CSV file:
City, Street, SubnetIP

I want to match the IP on my event with the SubnetIP of my CSV file to get this result

Result :
Date, URL, IP ( it matches witch SubnetIP), CITY

Kind regards

Steve

0 Karma
1 Solution

Path Finder

base search [|inputlookup lookup.csv|rename SubnetIP AS IP|table IP] --> it returns the results matching with the event and the lookup table

to derive city from the lookup table |lookup lookup.csv SubnetIP AS IP OUTPUT CITY

The total search query is going to be

base search [|inputlookup lookup.csv|rename SubnetIP AS IP|table IP]||lookup lookup.csv SubnetIP AS IP OUTPUT CITY | table Date URL IP City

View solution in original post

Path Finder

base search [|inputlookup lookup.csv|rename SubnetIP AS IP|table IP] --> it returns the results matching with the event and the lookup table

to derive city from the lookup table |lookup lookup.csv SubnetIP AS IP OUTPUT CITY

The total search query is going to be

base search [|inputlookup lookup.csv|rename SubnetIP AS IP|table IP]||lookup lookup.csv SubnetIP AS IP OUTPUT CITY | table Date URL IP City

View solution in original post

Engager

Indeed this search seems to works !
Really usefull thanks

Steve

0 Karma

Legend

Try this

... | lookup lokupfile.csv SubnetIP as IP OUTPUT City | table Date URL IP City
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!