Splunk Search

Use a lookup file to show IP name

WXY
Path Finder

Hello,I have a csv file ,and I use it as a lookup table, it has two fields : IP,IP Name;

| inputlookup ip_name.csv

and my data has source_ip, the source_ip corresponds to the IP in csv file.
I want to show a table such as : source_ip,IP Name
how do I write the SPL?

Tags (2)
0 Karma

renjith_nair
Legend

@WXY,

"your search to get source_ip" |lookup ip_name.csv IP AS source_ip

Reference : http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Lookup

Run anywhere example:

    |makeresults |eval ISO="Austria"|lookup geo_attr_countries.csv country as ISO
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...