How would I value map ip addresses?

[f_666dhn]

I have an example data on csv named invent.csv like this:

I want to map ip values ​​to host output using lookup using lookup, logic example:

input -> ip = 1.1.1.1 -> lookup to invent.csv -> output -> table hostname = host1

Thanks.

*Sorry for my bad eng 😁

[gcusello]

Hi @f_666dhn,

let me translate your question in Splunk language:

you have a lookup containing ip hostname and owner.

Then you have a search on an index containing ip address and you want to enrich your search on your index with hostname and owner, is it correct?

if this is your need, please try this search:

index=your_index
| lookup invent.csv ip OUTPUT host AS hostname owner
| table ip hostname owner

I supposed that the ip address has the same field name both in index and lookup, otherwise you have to rename it the lookup command.

Ciao.

Giuseppe