Splunk Search

Use Lookup Table with IP addresses to search in Splunk and find hostnames that match the IPs

Obsidian_RS400
New Member

I have a lookup table with a bunch of IP addresses (ipaddress.csv) and a blank column called hostname. I would like to search in splunk to find what hostnames each IP address have. I can find the hostnames in index=fs sourcetype=inventory. I'm just having a hardtime with the query logic of using the lookup table IPs to output to a table in splunk with their corresponding hostnames. Ideally I want to output the results in a table in splunk and add the hostnames back to the lookup table in the hostname column. Any help would be greatly appreciated! Thank you

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Obsidian_RS400 ,

let me understand:

you have a lookup with a list of ips but without hostname and you want to complete the lookup taking the hostnames from the events, is this correct?

If this is your requirement, you could run something like this:

assuming the in the lookup you have two fields IP and hostname and that in the events you have the same fields:

index=your_index
| dedup hostname IP
| fields IP hostname
| append [ | inputlookup ipaddress.csv | fields IP hostname ]
| stats values(hostname) AS hostname BY IP
| outputlookup ipaddress.csv

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...