After tooling with it more, I think the best approach uses the map command. | makeresults count=2 | streamstats count | eval index = case(count=1, "myindex1", count=2, "myindex2") | outputlookup lookup_of_events | stats count by index | map report_to_map_through_indexes report_to_map_through_indexes | inputlookup lookup_of_events where index="$index$" | collect index="$index$" ... View more

After working with support, it sounds like Splunk will update their documentation. For now, I provided the following for reference. Create an IAM role: curl -u admin:password https://localhost:8089/servicesNS/nobody/Splunk_TA_aws/splunk_ta_aws_iam_roles  -d name=<name> -d arn=<arn> Create a Metadata input: curl -u admin:password https://localhost:8089/servicesNS/nobody/Splunk_TA_aws/splunk_ta_aws_aws_metadata -d account=<account> -d aws_iam_role=<aws_iam_role> -d index=<index> -d regions=<regions> -d name=<name> ... View more

I discovered the issue. KV store collections need to be replicated to leverage automatic lookups. https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Makeyourlookupautomatic#Enable_replication_for_a_KV_store_collection ... View more

@yuanliuthis is a great approach. However, I need to be able to do this in SPL at search time. I was able to develop a little external lookup to do this, using the native ipaddress Python module. For those of you interested, here's the Python file "cidr_lookup.py".   #!/usr/bin/env python from __future__ import print_function import csv import ipaddress import sys # Given start and end IP addresses, return the CIDRs def lookup(ip_start, ip_end): try: cidrs = [str(ipaddr) for ipaddr in ipaddress.summarize_address_range( ipaddress.IPv4Address(ip_start), ipaddress.IPv4Address(ip_end) ) ] cidr_list = ','.join(cidrs) return cidr_list except: return '' def main(): if len(sys.argv) != 4: print("Usage: python cidr_lookup.py " "[ip_start field] [ip_end field] [cidr_list field]") sys.exit(1) ip_start_field = sys.argv[1] ip_end_field = sys.argv[2] cidr_list_field = sys.argv[3] infile = sys.stdin outfile = sys.stdout r = csv.DictReader(infile) header = r.fieldnames w = csv.DictWriter(outfile, fieldnames=header) w.writeheader() for result in r: if result[ip_start_field] and result[ip_end_field]: result[cidr_list_field] = lookup(result[ip_start_field], result[ip_end_field]) if result[cidr_list_field]: w.writerow(result) main()   Here's the transforms.conf.   [cidrlookup] external_cmd = cidr_lookup.py ip_start ip_end cidr_list fields_list = ip_start, ip_end, cidr_list   Here's a screenshot of the lookup in use.   ... View more

I tested this further, and it appears roles do have a lexicographical precedence based on the role name. ... View more