Splunk Search

Trying to map IP address from lookup table in search



I am trying to map the ip address in my search to my lookup table, and it should return me the countries of the IP address.

Sample lookup table

country ip_address

Problem is, in my events, my IP address is

I want to search the ip_address in the lookup table perhaps for 2.123.123 and return me Italy ?

This is my search query

index=ip_address "status=200" ip_address
| lookup ip_mapping.csv ip_address outputnew u_country as country

The search executed successfully, but there is no country being returned. What am i missing ?

0 Karma


You need to do several things.
1. configure a lookup definition which cidrmatching
2. reference the lookup definition name in the lookup command NOT the filename.csv. When you reference the file directly you bypass the lookup definition features and break your cidrmatching

1. Why are you using a custom table instead of updating the geolocation database and using the iplocation command?


0 Karma

Ultra Champion
0 Karma

Super Champion

assuming your lookup has field name as country and ip_addressthen try below search-

 index=ip_address "status=200" ip_address
 | lookup ip_mapping.csv ip_address OUTPUT  country as Country

After OUTPUT you need to specify lookup fieldname

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...