I want to add
AS number to ip by using some geo data.
This data has column
AS number and
network like below.
I uploaded this data as lookup, and configured lookup definitions with
Then I tried some ip addresses like below, but it didn't work.
| makeresults count=2 | streamstats count as c | eval network=if(c=1,"2001:4860:4860::8844","188.8.131.52") | lookup Geo_AS_Lookup network OUTPUT
So I extracted only the lines with the following two networks matching the test addresses, and created a lookup table and lookup definition newly.
AS_number,network xxxxx,2001:4860:4840::/42 yyyyy,184.108.40.206/19
Then it began to match well.
I wonder is there result limit of lookup?(* Because this lookup has about 440000 rows.)
If someone knows about it, please tell me.
Apparently the size is more concerned than the number of rows.
I made two pieces of data as below and found that the size of less than 10 MB matched well.
sample_geo.csv 27MB (500000 rows with 3 columns)
sample_geo_2.csv 8.95MB (500000 rows with 2 columns)
max_memtable_bytes = 20000000