Use a lookup file to tag IP blocks

arseniof — Tue, 29 Oct 2019 21:19:10 GMT

So what I want to do is tag all IPs that belong to certain AWS regions and filter out those IPs. I want to try and tag them the most efficient way. I thought maybe a lookup file with all of their IP blocks. Are lookup files capable of doing this? I know that you can just use
ip="52.95.245.0/24" and that would filter out all IPs in that block but they have a ton of regions which would be a really large query (almost 2000 blocks!). Any direction would be helpful. 🙂

Re: Use a lookup file to tag IP blocks

rmmiller — Tue, 29 Oct 2019 22:34:17 GMT

I just answered a similar question this morning about lookups using CIDR blocks:
https://answers.splunk.com/answers/777135/how-to-make-a-visualization-using-a-lookup-with-ip.html#answer-779812

Since tagging is last in the order of operations, it should be possible as long as you have information about all of the subnets in use across AWS regions.

rmmiller

topic Re: Use a lookup file to tag IP blocks in Splunk Search

Use a lookup file to tag IP blocks

Re: Use a lookup file to tag IP blocks