I want to add AS number to ip by using some geo data.
This data has column AS number and network like below.
I uploaded this data as lookup, and configured lookup definitions with CIDR(network).
Then I tried some ip addresses like below, but it didn't work.
| makeresults count=2
| streamstats count as c
| eval network=if(c=1,"2001:4860:4860::8844","18.104.22.168")
| lookup Geo_AS_Lookup network OUTPUT
So I extracted only the lines with the following two networks matching the test addresses, and created a lookup table and lookup definition newly.
Then it began to match well.
I wonder is there result limit of lookup?(* Because this lookup has about 440000 rows.)
If someone knows about it, please tell me.
Apparently the size is more concerned than the number of rows.
I made two pieces of data as below and found that the size of less than 10 MB matched well.
sample_geo.csv 27MB (500000 rows with 3 columns)
sample_geo_2.csv 8.95MB (500000 rows with 2 columns)
View solution in original post
max_memtable_bytes = 20000000