Splunk Search

Replacing multiple values in events with data from a lookup table.

cevans99
New Member

I am fairly new to Splunk so forgive me if this is a simple question. I have a lookup table with the following data:
IP_Address,Name,Comment
Each IP_Address field is populated in the table but some of the Name and Comment fields are not.

I have a search of my firewall logs that displays a src IP address and a dst IP address. I would like to replace the actual IP's with values from the lookup table. Basically, I am just needing to rename the src and dst fields to hostnames via a lookup table. I am able to get the lookup table to append (not replace) the data from the lookup table but only for one or the other (src or dst) but I really need it to replace both the src and dst IP's with the Name value from the lookup table.

Here is what I have so far. If someone could help guide me in the correct direction with the second half I would certainly appreciate the help. I have read the lookup documentation and examples but I'm a little confused about how to replace multiple values etc.

index=fwlog src=10.10.10.* |table src, dst |lookup IP_Data.csv IP_Address AS src OUTPUT Name

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index=fwlog src=10.10.10.* | table src, dst | lookup IP_Data.csv IP_Address AS src OUTPUT Name AS srcName | lookup IP_Data.csv IP_Address AS dst OUTPUT Name AS dstName

So now yo have 4 fields in your table and if you really need to drop down to 2, you can add this:

| table srcName dstName | rename *Name AS *

View solution in original post

woodcock
Esteemed Legend

Like this:

index=fwlog src=10.10.10.* | table src, dst | lookup IP_Data.csv IP_Address AS src OUTPUT Name AS srcName | lookup IP_Data.csv IP_Address AS dst OUTPUT Name AS dstName

So now yo have 4 fields in your table and if you really need to drop down to 2, you can add this:

| table srcName dstName | rename *Name AS *

cevans99
New Member

Thanks! Given your example I was closer than I thought, I wasn't using multiple LOOKUP/OUTPUT commands. Thank you so much!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...