topic Re: Automatic lookup, matching range field? in Knowledge Management

Automatic lookup, matching range field?

drejoe — Tue, 21 Aug 2018 13:27:29 GMT

Hi,

I would like to enriche netflow data (i.e. dst ip, dst port) with "service name", using automatic lookup.
My lookup looks like the following example:

IP             PORT_RANGE         SERVICENAME
x.x.x.x/32     1024,1048          ServiceA
y.y.y.y/30     80,80              ServiceB
z.z.z.z/31     8000,8999          ServiceC

OR the lookup could be with two PORT fields:

IP             PORT_MIN      PORT_MAX     SERVICENAME
x.x.x.x/32     1024          1048         ServiceA
y.y.y.y/30     80            80           ServiceB
z.z.z.z/31     8000          8999         ServiceC

Matching the IP is easy with match_type CIDR, BUT how-to match the port range???
Don't mind which of the two examples above to implement a solution for 😉
Or the solution could be a complete 3th solution.

Looking forward fore some bright answers,
Thanks,
//Torben

Re: Automatic lookup, matching range field?

JDukeSplunk — Tue, 21 Aug 2018 17:13:08 GMT

It sounds like a job for a lookup table. I don't know if you can do ranges in a lookup table..

https://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/LookupexampleinSplunkWeb

You may have to have a line entry for each port in the csv file to get it working. Not the best solution, but it is simple and might be the only solution.

So your csv lookup file might look like... And with excel if you enter two cells with consecutive numbers, you can click the corner and drag down to populate up to the number you like.

port,servicename
1024,ServiceA
1025,ServiceA
1026,ServiceA
1027,ServiceA
1028,ServiceA
1029,ServiceA
1030,ServiceA
1031,ServiceA
1032,ServiceA

etc...

Then you can either do an inline |inputlookup or do an automatic search that will create a new field called "ServiceName" or whatever.

Re: Automatic lookup, matching range field?

drejoe — Tue, 21 Aug 2018 20:15:43 GMT

Hi,

Thanks for the answer.

I've already tried this solution (before posting the question) with one line per port. But the amount of combinations is huge - millions of lines which won't work at all.

That's why I need another solution - a solution that can handle this ranges instead of "unfolding" all combinations.