topic Re: How to use the cidrmatch() function with IPV6 IP addresses? in Splunk Search

How to use the cidrmatch() function with IPV6 IP addresses?

fdi01 — Tue, 14 Apr 2015 07:06:03 GMT

The cidrmatch() function is used to identify IP addresses that belong to a particular subnet. How do I use it with IPV6 IP addresses? Syntax?

thanks

Re: How to use the cidrmatch() function with IPV6 IP addresses?

stephanefotso — Tue, 14 Apr 2015 09:03:55 GMT

Hello! I Firs i suggest that you follow this doc: https://blog.icann.org/wp-content/uploads/2010/07/ipv6-address-types.pdf
Then, for example to use the cidrmatch() for 2001:0000:4136:e378:8000:63bf:3fff:fdd2 address, you can just do something like this:

........... | eval network=if(cidrmatch("2001:0000::/32",clientip), "local", "other")

which compare the IP addresses in the clientip field to a subnet range, and give the value local to the network if the value of clientip falls in the subnet range, Otherwise, network=other.

Re: How to use the cidrmatch() function with IPV6 IP addresses?

fdi01 — Tue, 14 Apr 2015 09:23:30 GMT

thank you but does not work .
i try like that:
| eval network=if(cidrmatch("2001:0000::/32",2001:0000:4136:e378:8000:63bf:3fff:fdd2), "local", "other")
but no isue. and i have this error:
Error in 'eval' command: The expression is malformed. Expected ).

Re: How to use the cidrmatch() function with IPV6 IP addresses?

stephanefotso — Tue, 14 Apr 2015 13:13:31 GMT

you don't need to test like this. My query suppose that you have a field named clientip, with IPV6 IP addresses in your events. To test with a value of clientip try this:

  your base search  | eval network=if(cidrmatch("2001:0000::/32","2001:0000:4136:e378:8000:63bf:3fff:fdd2"), "local", "other")

I think it will work

Re: How to use the cidrmatch() function with IPV6 IP addresses?

fdi01 — Tue, 14 Apr 2015 13:18:33 GMT

it work fine Mr stephanefotso is it cool