How to write a search to output results where a field from my events match with a field in my lookup CSV file?

[geantver0000]

Hi,

I have found many searches using lookup files, but none works correctly for me What is the correct search to get this?:

My event :
Date, URL, IP

My lookup CSV file:
City, Street, SubnetIP

I want to match the IP on my event with the SubnetIP of my CSV file to get this result

Result :
Date, URL, IP ( it matches witch SubnetIP), CITY

Kind regards

Steve

[splunkton · Accepted solution]

base search [|inputlookup lookup.csv|rename SubnetIP AS IP|table IP] --> it returns the results matching with the event and the lookup table

to derive city from the lookup table |lookup lookup.csv SubnetIP AS IP OUTPUT CITY

The total search query is going to be

base search [|inputlookup lookup.csv|rename SubnetIP AS IP|table IP]||lookup lookup.csv SubnetIP AS IP OUTPUT CITY | table Date URL IP City

[geantver0000]

Indeed this search seems to works !
Really usefull thanks

Steve

[sundareshr]

Try this

... | lookup lokupfile.csv SubnetIP as IP OUTPUT City | table Date URL IP City