way to run mulitple fields against a lookup, with OR statement

[spicy]

I am trying to run two fields against one column using a lookup. 

This SPL does not work, but conveys what I am trying to do.

| lookup blacklist.csv ioc_list AS (src_ip OR dest_ip) OUTPUTNEW ioc_list,  feedback

Is there a way I can do something like the above command without running two separate lookup commands?

[bowesmana · Accepted solution]

@spicy 

You can use a multivalue field as the lookup, i.e.

| eval ioc_list_mv=mvappend(src_ip, dest_ip)
| lookup blacklist.csv ioc_list AS ioc_list_mv OUTPUT ioc_list as found_ioc_list,  feedback

Not sure your intentions with the OUTPUTNEW use case. If both src and dest ips exist in the lookup, then the lookup will only return the first value of the multivalue field it finds.

How many ips do you have in the lookup and have you found a performance issue with the lookup in general? You can setup a lookup definition that does batch requests if performance is an issue. You could also use a KV store with accelerated fields of the IP address which are pretty quick.

[spicy]

@bowesmana 

Thanks!

this will work for my needs, I only have one column of blacklist ips.