Splunk Search

Use a lookup file to show IP name

WXY
Path Finder

Hello,I have a csv file ,and I use it as a lookup table, it has two fields : IP,IP Name;

| inputlookup ip_name.csv

and my data has source_ip, the source_ip corresponds to the IP in csv file.
I want to show a table such as : source_ip,IP Name
how do I write the SPL?

Tags (2)
0 Karma

renjith_nair
Legend

@WXY,

"your search to get source_ip" |lookup ip_name.csv IP AS source_ip

Reference : http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Lookup

Run anywhere example:

    |makeresults |eval ISO="Austria"|lookup geo_attr_countries.csv country as ISO
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...