CODEWITHSUNDEEP
splunksplunk-query
Bond
Bond

Reputation: 945

Splunk comparison in lookup tables and display output

I have 2 lookup files as

  1. lookup1.csv and
  2. lookup2.csv

lookup1.csv has the data as below

name, designation, server, ipaddress, dept
tim, ceo, hostname.com, 1.2.3.5, alldept
jim, vp, myhost.com, 1.0.3.5, marketing
pim, staff, nohost.com, 4.0.4.8, hr

lookup2.csv has the data as below

cidr, location
1.2.3.0/24, dc
1.0.3.0/24, carolina
3.4.7.0/24, tx

I would like to lookup for the field ipaddress in lookup1.csv with the field cidr in lookup2.csv for the first 3 digits as in x.x.x and get the location field if they match. If the ipaddress doesn't match the first 3 digit of cidr , the location should be marked as "unknown".

Expected o/p

tim, ceo,1.2.4.5, dc
jim, vp, 1.0.3.5, carolina
pim, staff, 4.0.4.8, unkown

I am looking for the search command in splunk using the 2 lookup tables. Thanks in advance. My search so far has not yield any good results but I am still working on it.

Upvotes: 1

Views: 721

Answers (1)

RichG
RichG

Reputation: 9926

Use the isnull() function to determine if the lookup was successful or not.

| inputlookup lookup1.csv 
| lookup lookup2.csv cidr AS ipaddress OUTPUT location 
| eval location=if(isnull(location), "unknown", location)
| table name designation server ipaddress dept location

Upvotes: 1

Related Questions