Using inputlookup as vlookup in a Subsearch

[NapalmYourMom]

I have the following main search:

index=utm sys=SecureNet action=drop
| eval protocol=case(proto==1, "ICMP", proto==6, "TCP", proto==17, "UDP", proto==132, "SCTP", 1=1,proto)
| table _time severity srcip srcport srcmac dstip dstport dstmac protocol eval action fwrule tcpflags ttl initf outitf
| sort -_time

On the existing eval, I need to modify the end that acts as the else. Right now, the  else specifies a name for numbers 1, 6, 17, and 132 in field "proto".  I need the else to use any other occurring number to lookup an associated name from a csv containing 2 fields: "number" and "name".

I cannot for the life of me figure out what kind of subsearch to use or the syntax... I imagine it is something like:

| inputlookup protocol_number_list.csv
| search number=proto
| return name

but I can't figure out how to combine the two.

Any help would be greatly appreciated, thanks!

[ITWhisperer]

index=utm sys=SecureNet action=drop
| lookup protocol_number_list.csv number AS proto OUTPUT name
| eval protocol=case(proto==1, "ICMP", proto==6, "TCP", proto==17, "UDP", proto==132, "SCTP", isnotnull(name), name, 1=1,proto)
| table _time severity srcip srcport srcmac dstip dstport dstmac protocol eval action fwrule tcpflags ttl initf outitf
| sort -_time

[NapalmYourMom]

Thank you so much - it would have been a long struggle to figure this out for myself.

Let me ask you something regarding computational resources:

I use the case statement to apply numbers 1,6, and 17 because they likely comprise 99% of events.  I did this to stop Splunk from having to access the CSV and traverse the list for every single event.

Do you think it Splunk is saving any significant resources by doing this?

Otherwise I would just go with:

index=utm sys=SecureNet action=drop
| lookup protocol_number_list.csv number AS proto OUTPUT name AS protocol
| table _time severity srcip srcport srcmac dstip dstport dstmac protocol eval action fwrule tcpflags ttl initf outitf
| sort -_time

 Testing this out doesn't appear to tax Splunk at all, which I am running in a Docker container.