topic Re: Lookup with CIDR in Splunk Search

Lookup with CIDR

ccsfdave — Tue, 02 Jul 2013 16:23:41 GMT

Greetings,

I feel like this shouldn't be rocket science,but I just can't make it work.

Our internal network is pretty complicated with IPs assigned to departments in pretty granular form. I would like to do the hard work ahead of time and put our IPAM (IP Address Management) into a lookup table. I am trying on a very small sample first to get it working then will add the rest.

transforms.conf

[ipam] filename = ipam.csv match_type = CIDR(src_ip)

props.conf

[ipam] LOOKUP-ipam = ipam Dept OUTPUTNEW Department

ipam.csv

src_ip,Dept 10.17.101.0/16,Some_Dept_Name 10.17.102.0/15,Some_Dept_Name

So if I do a search of 10.17.10*.* I would like to get a new Department field created with the value of Rec and Park assigned to it.

Thanks.

Dave

Re: Lookup with CIDR

MHibbin — Tue, 02 Jul 2013 16:38:12 GMT

Your lookup should probably be something like:

[ipam]
LOOKUP-ipam = ipam src_ip OUTPUTNEW Dept AS Department

I've note tested/tried this as I normally don't use the automatic lookups (for some reason).

Re: Lookup with CIDR

ccsfdave — Tue, 02 Jul 2013 16:43:31 GMT

Hmm, I get:

[DT-SPLK-Idx] Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'ipam' and lookup table 'ipam'.

After cutting and pasting your suggestion above. 😞 Thanks though!

Re: Lookup with CIDR

MHibbin — Wed, 03 Jul 2013 09:46:42 GMT

@ccsfdave, Hmmm... try changing the src_ip field in your lookup to srcip, and then change it in you transforms.conf. Then change the props.conf to the following:

LOOKUP-ipam = ipam srcip AS src_ip OUTPUTNEW Dept AS Department

Re: Lookup with CIDR

ccsfdave — Wed, 03 Jul 2013 14:31:13 GMT

So I am half way there, I will actually open a separate answer for the next issue because it is not directly related to making the lookup work.

The issue here was that in the props, the bracketed words are a sourcetype. The documentation was either missing this detail or I skimmed over it. Hopefully this post will help someone else.

transforms.conf

[ipam] filename = ipam.csv match_type = CIDR(src_ip)

props.conf

[cisco_asa] LOOKUP-ipam = ipam src_ip OUTPUTNEW Dept AS Department

ipam.csv

src_ip,Dept 10.17.101.0/16,Some_Dept_Name 10.17.102.0/15,Some_Dept_Name

Re: Lookup with CIDR

MHibbin — Wed, 03 Jul 2013 15:57:19 GMT

I completely overlooked that!

Re: Lookup with CIDR

ccsfdave — Wed, 03 Jul 2013 18:34:26 GMT

MHibbin,

So do I need the same stanza for each source type in props.conf?