Solved: Matching Hostname to IP Between Two Lookups?

atebysandwich · ‎03-13-2023

I have two lookups. One lookup has Hostnames and IPs and the other has hostnames. I would like to run a search so I can take second lookup and see if its hostname is in the first, and if it is, show the hostname and the IP in the search results.

richgalloway · ‎03-13-2023

If I understand the matter right, this should get you started.

| inputlookup lookup2
| lookup lookup1 hostname
| where isnotnull(ip)
| table hostname ip

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎03-13-2023

If I understand the matter right, this should get you started.

| inputlookup lookup2
| lookup lookup1 hostname
| where isnotnull(ip)
| table hostname ip

---
If this reply helps you, Karma would be appreciated.

Matching Hostname to IP Between Two Lookups?

eval

fields

lookup

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Rounding off the Splunk Dashboard Contest

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

Join the Conversation