topic Re: Splunk lookup (not inputlookup) and cidr matching in Splunk Search

Splunk lookup (not inputlookup) and cidr matching

cybersecnutant — Wed, 10 Jan 2024 21:47:59 GMT

Hello,

I have a search that's coming back with 'src' which is the source IP of a client, and I have a lookup file called "networks.csv" that has a column with a header 'ip' which is a list of CIDR networks. I have gone into the lookup definitions and set under the advanced options "CIDR(ip)" for that lookup file. I can see the headers being automatically being extracted in that UI. However, when I run the search and try to pull the category for the 'src' respective network, it does not work.

basesearch
| lookup networks.csv ip as src_ip OUTPUT category

I have validated that it's a CIDR issue by doing a "...| rex mode=sed field=src_ip " and placing a literal CIDR entry in there and having the category come out.

Thank you for your help!

Re: Splunk lookup (not inputlookup) and cidr matching

dtburrows3 — Wed, 10 Jan 2024 22:01:22 GMT

Do you have the same issue when referencing the lookup definition itself instead of the CSV file?
Example:

<base_search> | lookup <lookup definition pointing to networks.csv> ip as src_ip OUTPUT category

I think that the advanced settings may only be applied when referencing the definition.

Re: Splunk lookup (not inputlookup) and cidr matching

cybersecnutant — Wed, 10 Jan 2024 22:13:12 GMT

Thank you! That was it.