topic CIDR search against multivalue fields in Splunk Search

CIDR search against multivalue fields

rooney — Fri, 06 Jan 2012 16:20:03 GMT

I'm using the Splunk for Cisco IPS app which outputs some events with multiple targets with IP addresses:

target=a.a.a.a target=b.b.b.b target=c.c.c.c ... target=n.n.n.n.

If I search with target=a.a.a.0/24, then I get a match, but searching for target=b.b.b.0/24 or any of the later values does not match. Is there a way to properly CIDR search through all the values of a multivalue field?

Re: CIDR search against multivalue fields

dwaddle — Fri, 06 Jan 2012 22:25:19 GMT

I would have expected this to work. Alternately, I might suggest use of where and cidrmatch. Something like

blah blah blah | where cidrmatch(target,"b.b.b.0/24")

Re: CIDR search against multivalue fields

rooney — Sat, 07 Jan 2012 05:11:01 GMT

Unfortunately that yields the same result, matches with cidrmatch(target,"a.a.a.0/24") but nothing else.

Re: CIDR search against multivalue fields

rooney — Wed, 25 Jan 2012 20:00:48 GMT

The problem was the target, target_port, and target_locality fields hadn't actually been set as MV fields by default. So by adding the following, it now works properly:

props.conf:

[cisco_ips_syslog]
REPORT-target = target,target_port,target_locality

transforms.conf:

[target]
REGEX = target=\"(.+?)\"
FORMAT = target::$1
MV_ADD = True

[target_port]
REGEX = target_port=\"(.+?)\"
FORMAT = target_port::$1
MV_ADD = True

[target_locality]
REGEX = target_locality=\"(.+?)\"
FORMAT = target_locality::$1
MV_ADD = True