Splunk Search

Lookup when format is not equal.

lakromani
Builder

I already have a CSV file for an other app that uses mac to IP/Name.

Format is like this:

mac,ip,host_name
6067.209c.ce2c,10.10.10.186,pc-test
c01a.da25.da0e,10.10.10.163,server
100b.a91e.5cdc,10.10.10.160,phone

Now I have an other input that looks like this:

nic1 BC:F2:AF:C6:F0:25 TX 209 mbps
nic1 BC:F2:AF:C6:F0:18 TX 129 mbps

Is there a way to do a lookup for the mac in the mac to IP/Host file when format is different?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could schedule a search that adds the other format to the lookup file periodically, and use that in your automatic lookup. Something like this:

| inputlookup file
| eval mac2 = coalesce(mac2, replace(replace(upper(mac), "\.", ""), "([^:][^:])(?!$)", "\1:"))
| outputlookup file

You'd have the original value in mac and the other notation in mac2.

0 Karma

jkat54
SplunkTrust
SplunkTrust

You can use evals to change the format prior to the lookup. I often take everything to lowercase/uppercase prior to joins and lookups. Your requirements would be a bit trickier but Martin has done the tricky eval part it appears.

Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...