append new column based on presearch results

[hjwang]

Hi there,i i would like to append new colunms to presearch results,for example,the search

host="x.x.x.x" eventtype="yyy" | stats count(SRC_IP) by SRC_IP | sort - count(SRC_IP) | head 10

The results will be top 10 SRC_IP and its "counts". Now if i wanna know each row's SRC_IP from which country, how can i do further search? (use subsearch?)? In general to say, how to append new column based on presearch? thanks

[dwaddle]

For this particular problem, I think there is an app in Splunkbase that will help with it. There is a MAXMIND GeoIP app at http://splunkbase.splunk.com/apps/All/4.x/Add-On/app:Geo+Location+Lookup+Script

host="x.x.x.x" eventtype="yyy" 
| stats count(SRC_IP) by SRC_IP 
| sort - count(SRC_IP) 
| head 10
| lookup geoip SRC_IP as iplocation

[hjwang]

i found the correcy sytax will be 【lookup geoip clientip as SRC_IP OUTPUT client_country as country】, thanks

[hjwang]

Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table. The lookup table fields_list=clientip client_country client_region client_city client_lat client_lon. but it still not work when replacing SRC_IP with clientip