Search code examples
splunk

Splunk lookup table returns empty result

I have a simple lookup table as following

enter image description here

But when I lookup the table it returns empty results

| makeresults 
| eval ip="10.10.10.10"
| lookup my_test ip as ip output info as info

enter image description here

What was wrong?

Solution

  • How is the my_test lookup defined? By default, Splunk lookup tables perform strict text-matching searches. "10.10.10.10" does not match "10.10.10.10/32" so lookup returns nothing.

    To match CIDR addresses, the lookup must be defined to use them on specific fields. Go to Settings->Lookups->Lookup definitions and select my_test. Tick the "Advanced options" box and enter "CIDR(ip)" in the "Match type" box. Then click Save.