topic Re: subnet information in Splunk Search

subnet information

nishit_92 — Fri, 13 Sep 2019 20:04:12 GMT

I have subnet lookup in cidr notation. so i am trying to print subnet detail with dest ip but not getting result.

query:-
index=xyz | stats count by dest | lookup subnet.csv subnet as dest output subnet as subnets

I have no any transformation stanza right now so let me know if any other staza require to compute this or any other way.

Re: subnet information

maciep — Sat, 14 Sep 2019 14:13:10 GMT

Yes, either in the web gui or in transforms.conf (which is where the web will write it), you need to specify the match type for that field.

https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Transformsconf#Lookup_tables

match_type = <string>
* A comma and space-delimited list of <match_type>(<field_name>)
  specification to allow for non-exact matching
* The available match_type values are WILDCARD, CIDR, and EXACT. Only fields 
  that should use WILDCARD or CIDR matching should be specified in this list.
* Default: EXACT

So probably something like this in transforms:

[subnet]
filename = subnet.csv
match_type = CIDR(subnet)

And if you want the lookup to happen automatically, that would be in props.conf (but also in the web).

So the simple lookup is in the lookups directory. The table definition (case sensitivity, wildcards, max matches, etc) is defined in transforms. And automatically running the lookup command for host/source/sourcetype is done in props.

Re: subnet information

nishit_92 — Sat, 14 Sep 2019 18:13:57 GMT

Thanks @maciep
Also, I am not aware about connectivity between props.conf and automatic lookup. Thanks for sharing.