topic IP Range Lookup in Splunk Search

IP Range Lookup

splunkrocks2014 — Thu, 25 May 2017 18:25:40 GMT

I have IP lookup table (ips.csv) mixed with different types of formats such as

ip
-----------------------
192.168.1.0/24
192.168.2.0-192.168.2.36
192.168.3.3

From transforms.conf, I defined a ip_lookup object as the following:

 [ip_lookup]
 filename = ips.csv
 match_type = CIDR(ip)

Does my lookup work with single IP or a IP range like this, 192.168.2.0-192.168.2.36?

Thanks.

starcher — Thu, 25 May 2017 19:49:07 GMT

cidr lookups have to be in /mask format. if the line is a single IP it should be 192.168.3.3/32

adonio — Thu, 25 May 2017 19:50:22 GMT

can you elaborate? what is the problem you are trying to solve?

splunkrocks2014 — Thu, 25 May 2017 20:22:49 GMT

Thank you starcher. This is what I am looking for.

splunkrocks2014 — Thu, 25 May 2017 20:23:25 GMT

I got the answer from starcher. Thank you for asking.