Hello,
I have a lookup table that looks like below:
dns ip
server1 ip1,ip2,ip3
server2 ip4,ip5,ip6
server3 ip7
server4 ip8,ip9,ip10,ip11
So I have a Splunk search that generates a table with IP addresses and I want to automatically populate the relevant dns names
I use the following but it does not work:
| lookup lookup.csv "ip" AS IpAddress OUTPUT "dns" AS server_name
Any idea how to solve it?
Thanks
Lookup tables expect to find the exact string in the given column. They do not do substring matching nor to they support multi-value. IOW, it will not find 'ip2' because the column contains the single value 'ip1,ip2,ip3'.
You will need to restructure the lookup table to have a single IP address in each row.
dns ip
server1 ip1
server1 ip2
server1 ip3
server2 ip4
server2 ip5
server2 ip6
server3 ip7
server4 ip8
server4 ip9
server4 ip10
server4 ip11