Splunk Search

Query help lookup

surekhasplunk
Communicator

Hi,

I am using below query to get a match by SUBNET from B.csv and get the IP filed.
And show all fields from A.csv with the matching SUBNET from b.csv and get the IP field.

| inputlookup A.csv |bla blal | where arp_usage_percentage>60 | rename subnet_global as SUBNET |lookup B.csv SUBNET output IP

But now i am facing issue where all the IPs are not show in my result. Only 100 records are coming whereas there are more than that.

Why i am getting only 100 results and is there any other way to show.

Tags (2)
0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

You are using OUTPUT clause which makes the output lookup fields overwrite existing fields in the events. You can use below query to preserve IP field:

| inputlookup A.csv |bla blal | where arp_usage_percentage>60 | rename subnet_global as SUBNET | lookup B.csv SUBNET OUTPUT IP AS MATCHED_IP
0 Karma

surekhasplunk
Communicator

Hi @manjunathmeti ,

Thanks for the reply but looks its the same even if i use IP as MATCHED_IP
Note: there is no IP field in A.csv file. So overwriting cant be the issue from my point of view.
there is something which just limits and so we are getting only 100 IPs for each of the SUBNET

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!