Solved: Re: Match Hostname to IP Between Two Lookups

atebysandwich · ‎03-13-2023

I have two lookups. One lookup has Hostnames and IPs and the other has hostnames. I would like to run a search so I can take second lookup and see if its hostname is in the first, and if it is, show the hostname and the IP in the search results.

richgalloway · ‎03-13-2023

If I understand the matter right, this should get you started.

| inputlookup lookup2
| lookup lookup1 hostname
| where isnotnull(ip)
| table hostname ip

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎03-13-2023

If I understand the matter right, this should get you started.

| inputlookup lookup2
| lookup lookup1 hostname
| where isnotnull(ip)
| table hostname ip

---
If this reply helps you, Karma would be appreciated.

Matching Hostname to IP Between Two Lookups?

eval

fields

lookup

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...

Join the Conversation