Splunk Search

Search lookup rename and use values not in CSV file

cdohertypp
New Member

Wondering can this be done - I'm trying to use IPs (there's 50 of them) from a CSV file for a dashboard to Name ones commonly seen but I would also like to have IPs displayed not in the CSV file to be charted both the field in Splunk and the one in the CSV are called "src".

So far I've been able to translate the IPs in the CSV, but unable to display the whole results without losing the name of the IPs from the CSV file.

What am I doing wrong here? I've tried a number of different ways but suspect its something very simple I've missed

index=fw service=22 dst=22.168.X.X | lookup ip_fw src AS src OUTPUT name_ip | stats count by name_ip

ip_fw csv file
src,name_ip
193.101.X.12,CompanyA
213.101.X.13,CompanyB
103.101.X.12,CompanyC

0 Karma
1 Solution

DavidHourani
Super Champion

Hi @cdohertypp,

You could try to use fillnull or and if statement to fill out all the values that didn't match, I think something like this should do the trick for you:

  index=fw service=22 dst=22.168.X.X | lookup ip_fw src AS src OUTPUT name_ip | eval name_ip=if(isnull(name_ip), src, name_ip) | stats count by name_ip

Let me know if that helps.

Cheers,
David

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @cdohertypp,

You could try to use fillnull or and if statement to fill out all the values that didn't match, I think something like this should do the trick for you:

  index=fw service=22 dst=22.168.X.X | lookup ip_fw src AS src OUTPUT name_ip | eval name_ip=if(isnull(name_ip), src, name_ip) | stats count by name_ip

Let me know if that helps.

Cheers,
David

View solution in original post

0 Karma

cdohertypp
New Member

Thanks mate that did it cheers

but had to change the eval to

eval name_ip=if(isnull(name_ip), src, name_ip)

Gent

0 Karma

DavidHourani
Super Champion

Awesome ! Glad to know it worked, edited the answer and replaced by src 🙂

0 Karma

sandeepmakkena
Contributor

I can't get what you want here, can you make it clear.

0 Karma

cdohertypp
New Member

Basically whatever IPs are in the CSV file id like the corresponding compamny name on the chart instead or in addition to the IP in the firewall logs ...but also IPs that are not in the CSV to be displayed also so ive full visibility of all traffic

Hope that makes sense

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.