https://community.splunk.com/t5/Splunk-Search/How-to-read-a-file-and-use-the-data-inside-in-a-eval-function/m-p/354030#M104778 <P>I am new using Splunk, sorry.<BR /> I need to separate a lot of subnets by name. I would like (txt) to read a file kind of:</P> <P>10.0.1.0/16 NAME1<BR /> 10.5.0.0/24 NAME2<BR /> ...</P> <P>I am using this search now : | eval org=case(cidrmatch("10.118.68.0/23",src),"NAME1", cidrmatch("10.118.103.0/26",src_ip),"NAME2") | stats by org</P> <P>The question is that I have a lot of subnets and I need to simplify the query, and I wonder if is there any way to read a file in the eval function, using awk or something like that?</P> <P>Thanks in advance.</P> Tue, 14 Mar 2017 15:31:06 GMT langanix 2017-03-14T15:31:06Z https://community.splunk.com/t5/Splunk-Search/How-to-read-a-file-and-use-the-data-inside-in-a-eval-function/m-p/354030#M104778 <P>I am new using Splunk, sorry.<BR /> I need to separate a lot of subnets by name. I would like (txt) to read a file kind of:</P> <P>10.0.1.0/16 NAME1<BR /> 10.5.0.0/24 NAME2<BR /> ...</P> <P>I am using this search now : | eval org=case(cidrmatch("10.118.68.0/23",src),"NAME1", cidrmatch("10.118.103.0/26",src_ip),"NAME2") | stats by org</P> <P>The question is that I have a lot of subnets and I need to simplify the query, and I wonder if is there any way to read a file in the eval function, using awk or something like that?</P> <P>Thanks in advance.</P> Tue, 14 Mar 2017 15:31:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-read-a-file-and-use-the-data-inside-in-a-eval-function/m-p/354030#M104778 langanix 2017-03-14T15:31:06Z https://community.splunk.com/t5/Splunk-Search/How-to-read-a-file-and-use-the-data-inside-in-a-eval-function/m-p/354031#M104779 <P>What you need is to create a lookup table file with all those CIDR and name mapping, create a lookup transform to do cidr match. They you should be able to use lookup command to match and fetch name OR you can setup automatic lookup to get the name automatically. See this link for details.</P> <P><A href="https://answers.splunk.com/answers/5916/using-cidr-in-a-lookup-table.html">https://answers.splunk.com/answers/5916/using-cidr-in-a-lookup-table.html</A></P> Tue, 14 Mar 2017 15:52:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-read-a-file-and-use-the-data-inside-in-a-eval-function/m-p/354031#M104779 somesoni2 2017-03-14T15:52:02Z https://community.splunk.com/t5/Splunk-Search/How-to-read-a-file-and-use-the-data-inside-in-a-eval-function/m-p/354032#M104780 <P>Thank you very much for you answer!</P> Tue, 14 Mar 2017 15:55:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-read-a-file-and-use-the-data-inside-in-a-eval-function/m-p/354032#M104780 langanix 2017-03-14T15:55:39Z