Splunk Search

How would I value map ip addresses?

f_666dhn
Explorer

I have an example data on csv named invent.csv like this:

f_666dhn_0-1681968677658.png

I want to map ip values ​​to host output using lookup using lookup, logic example:

input -> ip = 1.1.1.1 -> lookup to invent.csv -> output -> table hostname = host1

Thanks.


*Sorry for my bad eng 😁

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @f_666dhn,

let me translate your question in Splunk language:

you have a lookup containing ip hostname and owner.

Then you have a search on an index containing ip address and you want to enrich your search on your index with hostname and owner, is it correct?

if this is your need, please try this search:

index=your_index
| lookup invent.csv ip OUTPUT host AS hostname owner
| table ip hostname owner

I supposed that the ip address has the same field name both in index and lookup, otherwise you have to rename it the lookup command.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Transforming Financial Data into Fraud Intelligence

Every day, banks and financial companies handle millions of transactions, logins, and customer interactions ...

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...