Splunk Search

Splunk Lookup overide

sumitkathpal
Explorer

Hi Team,

we have lookup file which is doing enrichment however we have define the lookup using CIDR values of ip address and working well.
below is lookup file working well
ip mac nt_host dns owner priority lat long city country bunit category
10.228.80.0/24 is category as workstation

now we have ip 10.228.80.50 which we need to categorized as laptop , how we can do that , right now everything is coming as workstation

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you tried adding "10.228.80.50 laptop" to the lookup file before the "10.228.80.0/24" entry? The first match in the file should prevail.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...