Looking for more help on this. I came across this scenario when no results came back from the lookup table, but I still want to do something with the IP.
Ex.
| inputlookup tablename | where IP="x.x.x.x" | stats count | eval result=if(count==0, IP, Company) | iplocation IP | fields IP, Company, City, Region, Country
So basically if no results come back I still want to return the Geo information on the IP. If there are results then I want the results from the lookup and also return the Geo information.
... View more