topic Re: KV Store field type cidr in Knowledge Management

KV Store field type cidr

mathiask — Fri, 31 Aug 2018 10:14:54 GMT

Hello Splunkers

I just noticed that there is a field type "cidr" for the KV Store.
According to the API documentation this should handle any kind of IP ranges nicely in canonical form.
http://docs.splunk.com/Documentation/Splunk/7.1.2/RESTREF/RESTkvstore#CIDR

Until now we used field type string
field.netrange = string

I created a new collection for testing with
field.netrange = cidr
and transferred the content with | inputlookup | outputlookup

But upon inspection | inputlookup

I still observe the previous non-canonical IP ranges like 2001:620:2000::/48

Did I do something wrong?

What is the benefit of using the field type cidr when there are no changes?

Re: KV Store field type cidr

vsingla1 — Mon, 11 Mar 2019 00:12:18 GMT

I have the same issue. @mathiask Did you ever get to resolve this issue? If so, Can you please share your solution here.

Re: KV Store field type cidr

mathiask — Mon, 11 Mar 2019 09:09:44 GMT

Sadly, I did not further investigate or resolve this issue yet.

Re: KV Store field type cidr

stephaniem_splu — Thu, 21 Mar 2019 20:51:52 GMT

There is no additional benefit. CIDR is implicit: https://docs.splunk.com/Documentation/Splunk/6.3.1/RESTREF/RESTkvstore

Re: KV Store field type cidr

mathiask — Fri, 22 Mar 2019 12:39:11 GMT

I am not sure if I understand this correctly
According to the documentation the field using field.cidr should be converted to a canonical CIDR address
https://docs.splunk.com/Documentation/Splunk/7.2.5/RESTREF/RESTkvstore#CIDR

Could you sort elaborate on what you mean with implicit?

Re: KV Store field type cidr

nickhills — Fri, 22 Mar 2019 13:22:40 GMT

2001:620:2000::/48 is already a canonical address.
(I think its clearer with IPv4)
172.16.14.0/24 is also a canonical address
172.16.14.34 is NOT a canonical address, so this would be converted to its canonical version which would be:
172.16.14.34/32