Splunk Search
Highlighted

append new column based on presearch results

Contributor

Hi there,i i would like to append new colunms to presearch results,for example,the search

host="x.x.x.x" eventtype="yyy" | stats count(SRC_IP) by SRC_IP | sort - count(SRC_IP) | head 10

The results will be top 10 SRC_IP and its "counts". Now if i wanna know each row's SRC_IP from which country, how can i do further search? (use subsearch?)? In general to say, how to append new column based on presearch? thanks

0 Karma
Highlighted

Re: append new column based on presearch results

SplunkTrust
SplunkTrust

For this particular problem, I think there is an app in Splunkbase that will help with it. There is a MAXMIND GeoIP app at http://splunkbase.splunk.com/apps/All/4.x/Add-On/app:Geo+Location+Lookup+Script

host="x.x.x.x" eventtype="yyy" 
| stats count(SRC_IP) by SRC_IP 
| sort - count(SRC_IP) 
| head 10
| lookup geoip SRC_IP as iplocation
Highlighted

Re: append new column based on presearch results

Contributor

Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table. The lookup table fieldslist=clientip clientcountry clientregion clientcity clientlat clientlon. but it still not work when replacing SRC_IP with clientip

0 Karma
Highlighted

Re: append new column based on presearch results

Contributor

i found the correcy sytax will be 【lookup geoip clientip as SRCIP OUTPUT clientcountry as country】, thanks

0 Karma