Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Splunk search lookup
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have a data that returns ip field and values as below.
Ip = 0.0.0.11
Ip= 0.0.0.12
There is a lookup that contains field ipaddress with below values
0.0.0.11
0.0.0.13
If we see above 0.0.0.12 missed in the lookup,
I need a search to return 0.0.0.11(existed in both query result and lookup) and 0.0.0.12 (entries which are not in lookup and update them as ip=0.0.0.0 in result)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could use the following SPL to achieve this:
| makeresults
| eval ip="0.0.0.11,0.0.0.12"
| makemv ip delim=","
| mvexpand ip
``` End of sample data ```
| lookup your_lookup_file ipaddress as ip OUTPUTNEW ipaddress as found_ip
| eval ip=if(isnull(found_ip), "0.0.0.0", ip)🌟 Did this answer help you? If so, please consider:
- Adding karma to show it was useful
- Marking it as the solution if it resolved your issue
- Commenting if you need any clarification
Your feedback encourages the volunteers in this community to continue contributing
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could use the following SPL to achieve this:
| makeresults
| eval ip="0.0.0.11,0.0.0.12"
| makemv ip delim=","
| mvexpand ip
``` End of sample data ```
| lookup your_lookup_file ipaddress as ip OUTPUTNEW ipaddress as found_ip
| eval ip=if(isnull(found_ip), "0.0.0.0", ip)🌟 Did this answer help you? If so, please consider:
- Adding karma to show it was useful
- Marking it as the solution if it resolved your issue
- Commenting if you need any clarification
Your feedback encourages the volunteers in this community to continue contributing
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The lookup command will return null values when the target value is not present in the lookup table. It's up to the query to test the returned values and take appropriate action when null is returned.
If this reply helps you, Karma would be appreciated.
Credit Card Data Protection & PCI Compliance with Splunk Edge Processor
Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!
Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern
