Use Lookup Table with IP addresses to search in Splunk and find hostnames that match the IPs

[Obsidian_RS400]

I have a lookup table with a bunch of IP addresses (ipaddress.csv) and a blank column called hostname. I would like to search in splunk to find what hostnames each IP address have. I can find the hostnames in index=fs sourcetype=inventory. I'm just having a hardtime with the query logic of using the lookup table IPs to output to a table in splunk with their corresponding hostnames. Ideally I want to output the results in a table in splunk and add the hostnames back to the lookup table in the hostname column. Any help would be greatly appreciated! Thank you

[gcusello]

Hi @Obsidian_RS400 ,

let me understand:

you have a lookup with a list of ips but without hostname and you want to complete the lookup taking the hostnames from the events, is this correct?

If this is your requirement, you could run something like this:

assuming the in the lookup you have two fields IP and hostname and that in the events you have the same fields:

index=your_index
| dedup hostname IP
| fields IP hostname
| append [ | inputlookup ipaddress.csv | fields IP hostname ]
| stats values(hostname) AS hostname BY IP
| outputlookup ipaddress.csv

Ciao.

Giuseppe