topic Re: Multi Subnets in a Macro in Splunk Search

Multi Subnets in a Macro

albyva — Thu, 29 Aug 2013 18:16:40 GMT

How would you structure a macro to list dozens of IP Subnets?

For example: If you want a macro to list the following, what is the correct macro syntax?

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

Re: Multi Subnets in a Macro

lguinn2 — Thu, 29 Aug 2013 18:53:37 GMT

I am not sure why you want to use a macro. It would help if we had more context.

However, if I were going to run a search that needed to determine which events had IPs that matched a list of subnets, I would use a lookup.

I would create a file subnet.csv that contained

ip,subnetName
10.0.0.0/8,internal group 1
172.16.0.0/12,internal group 2
192.168.0.0/16,internal group 3

etc., and upload it to splunk as a lookup table.

props.conf

[yoursourcetypehere]
LOOKUP-lsubnet = subnet_lookup ip OUTPUT subnetName

transforms.conf

[subnet_lookup]
filename = subnet.csv
match_type = CIDR
min_matches = 1
max_matches = 1
default_match = unmatched

Then you could use this search to identify events from one of the subnets:

yoursearchhere | where subnetName != "unmatched"

Or this might be interesting

yoursearchhere | stats count by subnetName

Here is the Splunk Lookups Tutorial, if you need more info. One of the nice things about this solution is that you can edit and reload the csv file with new subnets as needed, and all of the searches that use the lookup will automatically use the latest list.

Re: Multi Subnets in a Macro

albyva — Thu, 29 Aug 2013 19:02:03 GMT

lguinn: You are right, I want to run a search and determine which events had IPs that matched a list of subnets. Where am I uploading this file? Thanks,

Re: Multi Subnets in a Macro

lguinn2 — Thu, 29 Aug 2013 23:35:13 GMT

When you are logged into Splunk, go to the app and then to Manager > Lookups

Under Actions for Lookup table files, click Add New.

This will upload the file to $SPLUNK_HOME/etc/apps/appname/lookups or you can move the file there directly via the OS.