topic Re: How do I use "cidrmatch" to pull a field from a csv using another field in the csv as the cidr? in Getting Data In

How do I use "cidrmatch" to pull a field from a csv using another field in the csv as the cidr?

Braagi — Thu, 30 Aug 2018 17:52:53 GMT

Yet another issue with "cidrmatch."
All I can get is DATA="Not working" to populate. I need it to populate with the data from the "extattrs" field. Any ideas?

| tstats count by host
| lookup dnslookup clienthost as host OUTPUT clientip as Source_IP
| lookup dnslookup clientip as Source_IP OUTPUT clienthost as SourceName

|append [|inputlookup ipam_report.csv |fields network, extattrs]
| eval DATA=if(cidrmatch(network, Source_IP), extattrs, "Not working")

| stats
values(host) as host
values(SourceName) as SourceName
values(count) as Counted
values(DATA) as DATA
by Source_IP
|sort - Counted
| table host, Source_IP, SourceName, DATA, Counted

Re: How do I use "cidrmatch" to pull a field from a csv using another field in the csv as the cidr?

Braagi — Fri, 07 Sep 2018 13:32:33 GMT

Edit: This is NOT an answer, it is a work around.

I have since been able to get the data I needed, but only on our instance of Splunk ES...and only on active searches, not scheduled. I think there may be a setting in the background that I am not aware of.

The code that works is :

 | tstats count by host

    | lookup dnslookup clienthost as host OUTPUT clientip as Source_IP
    | lookup dnslookup clientip as Source_IP OUTPUT clienthost as SourceName

    |lookup ipam_report.csv network AS Source_IP OUTPUT network, location, owner, sitecode, vlan

    | stats
    values(host) as host
    values(SourceName) as SourceName
    sum(count) as Counted
    values(network) as network
    values(location) as location
    values(owner) as owner
    values(sitecode) as sitecode
    values(vlan) as vlan
    by Source_IP
    |sort - Counted
    | table host, Source_IP, network, vlan, SourceName, sitecode, location, owner, Counted

Re: How do I use "cidrmatch" to pull a field from a csv using another field in the csv as the cidr?

mstjohn_splunk — Sat, 08 Sep 2018 00:05:59 GMT

hi @braagi, I'm glad you figured out a solution to your problem. I converted your comment to an answer so that users could learn from your solution. Would you mind approving it for me? Thanks!