I have 2 lookup files as
lookup1.csv has the data as below
name, designation, server, ipaddress, dept tim, ceo, hostname.com, 1.2.3.5, alldept jim, vp, myhost.com, 1.0.3.5, marketing pim, staff, nohost.com, 4.0.4.8, hr
lookup2.csv has the data as below
cidr, location 1.2.3.0/24, dc 1.0.3.0/24, carolina 3.4.7.0/24, tx
I would like to lookup for the field ipaddress in lookup1.csv with the field cidr in lookup2.csv for the first 3 digits as in x.x.x and get the location field if they match. If the ipaddress doesn't match the first 3 digit of cidr , the location should be marked as "unknown".
Expected o/p
tim, ceo,1.2.4.5, dc jim, vp, 1.0.3.5, carolina pim, staff, 4.0.4.8, unkown
I am looking for the search command in splunk using the 2 lookup tables. Thanks in advance. My search so far has not yield any good results but I am still working on it.
Hi @sbondred,
you have to configure your second lookup to match cidr:
and the run a simple search like the following:
| inputlookup lookup1.csv
| lookup lookup2.csv cidr AS ipaddress OUTPUT location
| table name designation server ipaddress dept location
Ciao.
Giuseppe
Actually, it was my lookuptable name I was using wrong. Its working. Thanks again @gcusello.
Hi @sbondred ,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉
Hi @sbondred,
you have to configure your second lookup to match cidr:
and the run a simple search like the following:
| inputlookup lookup1.csv
| lookup lookup2.csv cidr AS ipaddress OUTPUT location
| table name designation server ipaddress dept location
Ciao.
Giuseppe
Thanks @gcusello.
I setup the lookup definition to match type as CIDR(cidr) as that is the field name in the file and used the same search as mentioned below. For some reason, it does't provide me the location. It seems like it is not able to lookup for some reason. Still troubleshooting.