topic Re: Calculate network address in Splunk Search

Calculate network address

Nico99 — Wed, 10 Apr 2024 07:24:35 GMT

Hello everyone

I want to calculate the network address from an IP and a mask:

IP = 192.168.1.10
Mask = 255.255.255.0

Desired result = 192.168.1.0

Unfortunately I can't find a function or method to do this.

I looked for the 'cidrmatch' function but it only seems to return a boolean. Is there another way?

Thanks for your help!

Re: Calculate network address

ITWhisperer — Wed, 10 Apr 2024 10:03:20 GMT

If your netmask is fixed, you can use the ipmask function

| eval result=ipmask("255.255.255.0", IP)

Re: Calculate network address

Nico99 — Thu, 11 Apr 2024 07:08:34 GMT

Good morning,

Thank you for the feedback.

Unfortunately the netmask is not fixed...

I'll try with the app
https://splunkbase.splunk.com/app/6595

Re: Calculate network address

yuanliu — Thu, 11 Apr 2024 12:51:42 GMT

If you are willing to accept some acrobat, ipmask can be used even with variable net masks.

| map search="| makeresults |fields - _* | eval Network = ipmask(\"$Mask$\", $IP$), IP = $IP$, Mask = $Mask$"

Emulated data below should give

IP	Mask	Network
192.168.1.10	255.255.255.0	192.168.1.0
10.54.3.8	255.255.246.0	10.54.2.0

Here is the emulation for you to play with and compare with real data

| makeresults format=csv data="IP, Mask 192.168.1.10, 255.255.255.0 10.54.3.8, 255.255.246.0"

But again, to say 192.168.1.0 is a network address is (very) classism. The CIDR expressions should be

IP	Mask	Network
192.168.1.10	255.255.255.0	192.168.1.0/24
10.54.3.8	255.255.248.0	10.54.0.0/21

N'est-ce pas? This can be obtained with a bit of bit math, like this:

| map search="| makeresults |fields - _* | eval Mask = split($Mask$, \".\"), Mask = 32 - sum(mvmap(Mask, log(256 - Mask,2))), Network = ipmask(\"$Mask$\", $IP$) . \"/\" . Mask, IP = $IP$, Mask = $Mask$"

Re: Calculate network address

Nico99 — Mon, 15 Apr 2024 11:07:29 GMT

Hi yuanliu

Thank you for the feedback.

It's perfect! 🙂