Splunk Search

Use a lookup file to show IP name

WXY
Path Finder

Hello,I have a csv file ,and I use it as a lookup table, it has two fields : IP,IP Name;

| inputlookup ip_name.csv

and my data has source_ip, the source_ip corresponds to the IP in csv file.
I want to show a table such as : source_ip,IP Name
how do I write the SPL?

Tags (2)
0 Karma

renjith_nair
Legend

@WXY,

"your search to get source_ip" |lookup ip_name.csv IP AS source_ip

Reference : http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Lookup

Run anywhere example:

    |makeresults |eval ISO="Austria"|lookup geo_attr_countries.csv country as ISO
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.3.2411?

Hey Splunky People! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2411. This release ...

Buttercup Games: Further Dashboarding Techniques (Part 6)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...