Splunk search lookup

[Harikiranjammul]

Have a data that returns ip field and values as below.

Ip = 0.0.0.11

Ip= 0.0.0.12

There is a lookup that contains field ipaddress with below values

0.0.0.11

0.0.0.13

If we see above 0.0.0.12 missed in the lookup,

I need a search to return 0.0.0.11(existed in both query result and lookup) and  0.0.0.12 (entries which are not in lookup and update them as ip=0.0.0.0 in result) 

[livehybrid · Accepted solution]

Hi @Harikiranjammul 

You could use the following SPL to achieve this:

| makeresults 
| eval ip="0.0.0.11,0.0.0.12"
| makemv ip delim=","
| mvexpand ip
``` End of sample data ```
| lookup your_lookup_file ipaddress as ip OUTPUTNEW ipaddress as found_ip
| eval ip=if(isnull(found_ip), "0.0.0.0", ip)

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[richgalloway]

The lookup command will return null values when the target value is not present in the lookup table.  It's up to the query to test the returned values and take appropriate action when null is returned.