I apologize if this has already been answered, but I looked through numerous inquiries on answers.splunk.com and did not find one to match my issue. I have a CSV lookup table of CustID, CustName, srcip. I am charting the top 10 accesses by scrip over a time period. If the srcip is in the lookup table, I want to display the CustName, else display srcip.
This is my search:
sourcetype=access_combined | lookup TestIPs.csv src_ip OUTPUT CustName | chart count over CustName| sort -count limit=10
This results in a chart of only the Customer hits, but does not show any information from hits from non-customers. Theoretically, non-customer could be in the top 10 site users.
CustName count Customer3 10 Customer1 6 Customer2 3
CustName count 111.222.333.4 20 220.127.116.11 15 Customer3 10 18.104.22.168 7 Customer1 6 Customer2 3 22.214.171.124 2 126.96.36.199 1 188.8.131.52 1 184.108.40.206 1
sourcetype=access_combined | lookup TestIPs.csv src_ip OUTPUT CustName | eval CustName=coalesce(CustName, src_ip) | chart count over CustName| sort -count limit=10
This did not work, every record shows src_ip in the CustName field now including for customers, there are no customer names shown.
I downvoted this post because this did not work, every record shows src_ip in the custname field now including for customers, there are no customer names shown.
Try this instead
sourcetype=access_combined | lookup TestIPs.csv src_ip OUTPUT CustName | eval CustName=if(len(CustName) > 2, CustName, src_ip) | chart count over CustName| sort -count limit=10
Glad you found an answer to your question through @ntaylorsplunk 🙂 Please don't forget to resolve the post by clicking "Accept" directly below the answer.
I noticed you gave sundareshr a downvote for his attempted answer, but please note that for voting etiquette in this forum, it's best to only use downvoting for answers/suggestions that could potentially do harm to your environment. If an answer is helpful, it's encouraged to upvote it and that will already bump it up in the list of answers. If an attempted answer didn't get you what you needed, then no need to downvote someone for simply trying to help you out. We want to encourage community oriented behavior, not deter people from trying to help.
For more info in how voting etiquette works in this community, feel free to check out the discussion on this previous Splunk Answers post.
Thank you for the pointers. I was unaware of the proper-etiquette on answers.splunk.com.