topic Re: match_type = CIDR doesn't seem to work in Splunk Search

match_type = CIDR doesn't seem to work

ccsfdave — Mon, 28 Sep 2020 14:14:45 GMT

I have the following lookup:

transforms.conf

[ipam] filename = ipam.csv match_type = CIDR(src_ip)

props.conf

[cisco_asa] LOOKUP-ipam = ipam src_ip OUTPUTNEW Dept AS Department

ipam.csv

src_ip,Dept 10.8.1.0/10,Soap 10.17.101.0/16,Clean 10.17.102.0/15,Clean

When I do a search though, much more than what I would expect is being matched (I masked the results, the first is full the second and third are abbreviated for readability) :

» 7/3/13 7:42:30.000 AM Jul 3 07:42:30 ... %ASA-6-305012: Teardown dynamic TCP translation from inside:.../** to outside:.../** duration 0:00:30
host=... Options| sourcetype=cisco_asa Options| source=/var/log/syslog/blah.log Options| src_ip=10.35.36.20 Options| Department=Soap Options

» 7/3/13 7:42:30.000 AM

src_ip=10.15.1.12 Options| Department=Soap

» 7/3/13 7:42:30.000 AM

src_ip=10.17.31.174 Options| Department=Soap Options| Department=Clean

So as you can see the CIDR matching is not really working well. The first and second result are incorrect IP ranges for the Soap department and the third entry matches both departments when it should simply match Clean.

Re: match_type = CIDR doesn't seem to work

ccsfdave — Wed, 03 Jul 2013 15:31:08 GMT

BTW, the search was very open: sourcetype=cisco_asa Department="*"

Re: match_type = CIDR doesn't seem to work

gkanapathy — Wed, 03 Jul 2013 16:36:28 GMT

Actually, it is working correctly, but I think you are incorrectly specifying your CIDR ranges. For example, 10.8.1.0/10 (which is the same as 10.0.0.0/10) will match anything in the range 10.0.0.0 thru 10.63.255.255, which includes your other two ranges as well as your examples. 10.17.101.0/15 (which is the same as 10.16.0.0/15) includes everything in 10.16.*.* and 10.17.*.*.

My guess (just a guess) is that your ranges should actually all be /24 ranges. Though of course I don't know your network topology, you are unlikely to want overlapping CIDR ranges for different departments.

Re: match_type = CIDR doesn't seem to work

ccsfdave — Wed, 03 Jul 2013 16:43:38 GMT

DOH, let me verify...this is what I get for subnetting with an online calculator rather than doing it by hand...

Re: match_type = CIDR doesn't seem to work

ccsfdave — Wed, 03 Jul 2013 16:58:19 GMT

Ugh, right you were gkanapathy!