I have a field called lookup_key that contains either a host name or an IP address. I am trying to get a lookup on the IPs against a host table, and output them to a new field called host1. If the lookup_key field is already a host name just copy it to the new field. The address.csv has IPs in data1 and hosts in data2. Here is where i am currently, any help is appreciated. | eval lookup_key = if(match(lookup_key, "^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$"), "|lookup address1.csv data1 as lookup_key OUTPUT data2 as host1 ", "lookup_key=host1")
... View more