I have kind of a silly question that I am embarrassed to admit has stumped me for a little while.
I have a small list of server IP addresses and names that I would like to put in a lookup table file. I could easily create this file outside of Splunk, but I would prefer to construct a Splunk search to ensure it is built in a consistent way. So I am trying to construct a search which builds a table of static values and pipes the output to '|outputlookup' generate the lookup file. But I can't seem to find the right syntax to build a simple table with a name and IP column. I've tried various combinations of eval, append, appendpipe and I just can't seem to find the right syntax. The table is very simple:
name,ip
server1,ip1
server2,ip2
server3,ip3
This should get you what you want
| makeresults
| eval name="server1"
| eval ip="ip1"
| append
[| makeresults
| eval name="server2"
| eval ip="ip2"]
| append
[| makeresults
| eval name="server3"
| eval ip="ip3"]
| fields - _time | outputlookup filename
This should get you what you want
| makeresults
| eval name="server1"
| eval ip="ip1"
| append
[| makeresults
| eval name="server2"
| eval ip="ip2"]
| append
[| makeresults
| eval name="server3"
| eval ip="ip3"]
| fields - _time | outputlookup filename
sigh
That's why I was embarrassed. I knew it would be simple. Thanks!!
eh no need to be embarrassed. I wasn't sure I remembered how to do it 🙂