topic Re: Lookup table question in Splunk Search

Lookup table question

xvxt006 — Thu, 20 Jun 2013 16:37:48 GMT

Hi, i have a lookup table where i have the below values

My questions are:
When i specify CIDR block would it work? or do i need to specify each ip?
we have set of internal ips which you can see in the below table. I have specified .* in the IPs. For example 10.*.Would it consider all the ips that start with 10.
is it possible to specify a NOT logic? meaning NOT all the internal requests as external. so it would be ^10.*

WhitelistIPs    clientip
Company XXX 63.122.163.0/27 
Company YYYY    63.158.163.8
Company YYYY    64.274.165.6 
Company YYYY    38.172.74.18 
Company YYYY    12.298.108.202
Company YYYY    67.247.113.226
Company ZZZZ    74.189.118.39
Company ZZZZ    74.129.118.40
Internal    10.* 
Internal    167.115.*
Internal    192.168.*
Internal    63.85.20.233

Re: Lookup table question

theouhuios — Thu, 20 Jun 2013 18:01:40 GMT

You can use cidrmatch("65.222.163.0/27",clientip) for exact matches. For something which starts with 10, you can use match(). Example : match(Internal, "10.\d{1,3}.\d{1,3}.\d{1,3}")

You can use NOT logic too.

Re: Lookup table question

xvxt006 — Thu, 20 Jun 2013 18:40:06 GMT

Thank you !!!. But all of this i can use in the Lookup spreadsheet?

where clientip is the input filed and WhitelistIPs is the output field..

so the data would be like this?
WhitelistIPs clientip
Company XXX cidrmatch("65.222.163.0/27",clientip)
Company YYYY 63.158.163.8

Re: Lookup table question

theouhuios — Thu, 20 Jun 2013 22:11:45 GMT

It will depend. I guess you would need to set up your loookup in a way that it can give the clientip as output along with WhitelistIps. So for clientip as Input, both Clientip and WhitelistIp's need to be output. Then you can use the above functions and play around.

Do accept the answer if it works for you. Thanks

Re: Lookup table question

Ayn — Fri, 21 Jun 2013 09:07:18 GMT

You can't both have wildcard matching and cidr - it has to be one of them (and you need to specify that in transforms.conf)

Re: Lookup table question

theouhuios — Fri, 21 Jun 2013 14:22:11 GMT

Yup that's right.