https://community.splunk.com/t5/Getting-Data-In/Problems-with-cidrmatch-and-lookup-from-csv-even-after/m-p/298708#M93280 <P>Ok everyone, it seems that this is some sort of versioning issue--I downloaded free Splunk and installed it locally, added both lookup tables (and definitions) and this worked without problem.</P> <P>So, in production Im running Splunk Enterprise v6.5. Match_type = CIDR doesn't work somewhere between version 6.5 and 7.x. </P> <P>Note: on version 6.5 the cidrmatch function works inside an eval function, but not as a match type itself. Its weird.</P> Tue, 20 Feb 2018 03:30:54 GMT theothertomjone 2018-02-20T03:30:54Z https://community.splunk.com/t5/Getting-Data-In/Problems-with-cidrmatch-and-lookup-from-csv-even-after/m-p/298707#M93279 <P>I've read other questions on this topic and I am afraid I'm just stuck.</P> <P>I have a csv named "subnets_cidrmatch" with fields <EM>subnet, country</EM> (~250 entries in this spreadsheet).</P> <P>I have another csv named "spreadsheet" with a field <EM>clientip</EM> (~48k entries in this spreadsheet).</P> <P><STRONG>1. I have edited transforms.conf with the configuration below</STRONG></P> <P>[subnets_cidrmatch]<BR /> filename = subnets_cidrmatch.csv<BR /> default_match = NONE<BR /> match_type = CIDR(subnet)</P> <P><STRONG>2. The following query doesnt work (for some reason)</STRONG></P> <P>| inputlookup spreadsheet.csv <BR /> | lookup subnets_cidrmatch subnet AS clientip OUTPUT country as clientip_location<BR /> | table clientip subnet clientip_location </P> <P><STRONG>3. None of the fields match on the <EM>country</EM> (or the OUTPUT field *clientip_location)</STRONG>*</P> <P>Any idea what could be going on here?</P> Tue, 29 Sep 2020 18:08:23 GMT https://community.splunk.com/t5/Getting-Data-In/Problems-with-cidrmatch-and-lookup-from-csv-even-after/m-p/298707#M93279 theothertomjone 2020-09-29T18:08:23Z https://community.splunk.com/t5/Getting-Data-In/Problems-with-cidrmatch-and-lookup-from-csv-even-after/m-p/298708#M93280 <P>Ok everyone, it seems that this is some sort of versioning issue--I downloaded free Splunk and installed it locally, added both lookup tables (and definitions) and this worked without problem.</P> <P>So, in production Im running Splunk Enterprise v6.5. Match_type = CIDR doesn't work somewhere between version 6.5 and 7.x. </P> <P>Note: on version 6.5 the cidrmatch function works inside an eval function, but not as a match type itself. Its weird.</P> Tue, 20 Feb 2018 03:30:54 GMT https://community.splunk.com/t5/Getting-Data-In/Problems-with-cidrmatch-and-lookup-from-csv-even-after/m-p/298708#M93280 theothertomjone 2018-02-20T03:30:54Z https://community.splunk.com/t5/Getting-Data-In/Problems-with-cidrmatch-and-lookup-from-csv-even-after/m-p/298709#M93281 <P>Make sure the column subnet in your lookup is in CIDR format like 10.0.0.0/8 format.</P> Tue, 20 Feb 2018 18:15:52 GMT https://community.splunk.com/t5/Getting-Data-In/Problems-with-cidrmatch-and-lookup-from-csv-even-after/m-p/298709#M93281 starcher 2018-02-20T18:15:52Z https://community.splunk.com/t5/Getting-Data-In/Problems-with-cidrmatch-and-lookup-from-csv-even-after/m-p/298710#M93282 <P>It is in the correct CIDR format--the issue is the support for the match_type=CIDR between SE v6.5 and SE v7.x. Somewhere between these two versions the match_type=CIDR is fully supported.</P> Tue, 29 Sep 2020 18:06:29 GMT https://community.splunk.com/t5/Getting-Data-In/Problems-with-cidrmatch-and-lookup-from-csv-even-after/m-p/298710#M93282 theothertomjone 2020-09-29T18:06:29Z https://community.splunk.com/t5/Getting-Data-In/Problems-with-cidrmatch-and-lookup-from-csv-even-after/m-p/298711#M93283 <P>Did you ever get this resolved? I seem to be having the same issue.</P> Mon, 18 Feb 2019 20:14:42 GMT https://community.splunk.com/t5/Getting-Data-In/Problems-with-cidrmatch-and-lookup-from-csv-even-after/m-p/298711#M93283 dbray_sd 2019-02-18T20:14:42Z