- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have 2 lookup files as
- lookup1.csv and
- lookup2.csv
lookup1.csv has the data as below
name, designation, server, ipaddress, dept tim, ceo, hostname.com, 1.2.3.5, alldept jim, vp, myhost.com, 1.0.3.5, marketing pim, staff, nohost.com, 4.0.4.8, hr
lookup2.csv has the data as below
cidr, location 1.2.3.0/24, dc 1.0.3.0/24, carolina 3.4.7.0/24, tx
I would like to lookup for the field ipaddress in lookup1.csv with the field cidr in lookup2.csv for the first 3 digits as in x.x.x and get the location field if they match. If the ipaddress doesn't match the first 3 digit of cidr , the location should be marked as "unknown".
Expected o/p
tim, ceo,1.2.4.5, dc jim, vp, 1.0.3.5, carolina pim, staff, 4.0.4.8, unkown
I am looking for the search command in splunk using the 2 lookup tables. Thanks in advance. My search so far has not yield any good results but I am still working on it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![gcusello gcusello](https://community.splunk.com/legacyfs/online/avatars/553812.jpg)
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
Hi @sbondred,
you have to configure your second lookup to match cidr:
- go in [Settings > Lookup Definitions]
- flag on Advanced options
- put CIDR in the Match Type option
- save
and the run a simple search like the following:
| inputlookup lookup1.csv
| lookup lookup2.csv cidr AS ipaddress OUTPUT location
| table name designation server ipaddress dept location
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Actually, it was my lookuptable name I was using wrong. Its working. Thanks again @gcusello.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![gcusello gcusello](https://community.splunk.com/legacyfs/online/avatars/553812.jpg)
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
Hi @sbondred ,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![gcusello gcusello](https://community.splunk.com/legacyfs/online/avatars/553812.jpg)
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
Hi @sbondred,
you have to configure your second lookup to match cidr:
- go in [Settings > Lookup Definitions]
- flag on Advanced options
- put CIDR in the Match Type option
- save
and the run a simple search like the following:
| inputlookup lookup1.csv
| lookup lookup2.csv cidr AS ipaddress OUTPUT location
| table name designation server ipaddress dept location
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks @gcusello.
I setup the lookup definition to match type as CIDR(cidr) as that is the field name in the file and used the same search as mentioned below. For some reason, it does't provide me the location. It seems like it is not able to lookup for some reason. Still troubleshooting.
![](/skins/images/5D2DD17C284106BFBF80528D01D8AA1A/responsive_peak/images/icon_anonymous_message.png)