Splunk Search

Help with lookup to get table?

simo
Explorer

Hi,

I have a lookup as follow

ip id name
111.111.111.111 111 simone
* 222 marco

in the index I have 

ip id 
111.111.111.111 111
222.222.222.222 222
333.333.333.333 222

 

the result I'm looking for is the following

ip id  name
111.111.111.111 111 simone
222.222.222.222 222 marco
333.333.333.333 222 marco

 

can help me?

thank you

Simone

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried so far and why it didn't work for you.  Also, it's not clear what the key is in the lookup file.  Both ip and id appear to be the key, but only id is unique (at least in the example).

Did you try this?

| lookup mylookup.csv id OUTPUT name

If the asterisk in the ip column is intended as a wildcard then a standard lookup won't work because it treats the "*" literally.  The workaround is to create a lookup definition and add a wildcard field.

Go to Settings->Lookups->Lookup definition and click on New Lookup Definition.  Fill in the form to point to your lookup file then check the "Advanced options" box. In the "Match type" box enter WILDCARD(ip) and click Save.  Then the command becomes

| lookup mylookup ip id OUTPUT name

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried so far and why it didn't work for you.  Also, it's not clear what the key is in the lookup file.  Both ip and id appear to be the key, but only id is unique (at least in the example).

Did you try this?

| lookup mylookup.csv id OUTPUT name

If the asterisk in the ip column is intended as a wildcard then a standard lookup won't work because it treats the "*" literally.  The workaround is to create a lookup definition and add a wildcard field.

Go to Settings->Lookups->Lookup definition and click on New Lookup Definition.  Fill in the form to point to your lookup file then check the "Advanced options" box. In the "Match type" box enter WILDCARD(ip) and click Save.  Then the command becomes

| lookup mylookup ip id OUTPUT name

 

---
If this reply helps you, Karma would be appreciated.

simo
Explorer

@richgalloway thanks thats what i was looking for! 🙂

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...