Splunk Search

Trying to map IP address from lookup table in search

wailoont
Engager

Hi,

I am trying to map the ip address in my search to my lookup table, and it should return me the countries of the IP address.

Sample lookup table

country ip_address
Italy 2.123.123.9/24, 2.124.124.9/11

Problem is, in my events, my IP address is 2.123.123.1.

I want to search the ip_address in the lookup table perhaps for 2.123.123 and return me Italy ?

This is my search query

index=ip_address "status=200" ip_address
| lookup ip_mapping.csv ip_address outputnew u_country as country

The search executed successfully, but there is no country being returned. What am i missing ?

0 Karma

starcher
Influencer

You need to do several things.
1. configure a lookup definition which cidrmatching
2. reference the lookup definition name in the lookup command NOT the filename.csv. When you reference the file directly you bypass the lookup definition features and break your cidrmatching

Optional
1. Why are you using a custom table instead of updating the geolocation database and using the iplocation command?

https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Iplocation

0 Karma

to4kawa
Ultra Champion
0 Karma

493669
Super Champion

assuming your lookup has field name as country and ip_addressthen try below search-

 index=ip_address "status=200" ip_address
 | lookup ip_mapping.csv ip_address OUTPUT  country as Country

After OUTPUT you need to specify lookup fieldname

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...