topic IPv6 subnet as search parameter does not work (but IPv4 does!) in Splunk Search

IPv6 subnet as search parameter does not work (but IPv4 does!)

npichugin — Fri, 09 Aug 2013 07:31:40 GMT

Hello,

Let's say I'm trying to search for events where src_ip field matches some subnet:

search index=myindex src_ip="1.2.0.0/16"

This works perfectly. Now I want to run a similar search, but for IPv6 subnet:

search index=myindex src_ip6="1234:5678::/32"

This does NOT work. However, cidrmatch() function in "where" command works for both IPv4 and IPv6, so I consider search behaviour described above to be a bug.
Is this a known issue for Splunk developers? Is there a way to workaround this without using cidrmatch()?

P.S. Is it OK to report bugs here at splunkbase? I didn't found the Splunk bugtracker...

Re: IPv6 subnet as search parameter does not work (but IPv4 does!)

martin_mueller — Fri, 09 Aug 2013 09:49:24 GMT

Reporting suspected bugs here is quite okay, the more direct approach would be to submit a case here: https://www.splunk.com/page/submit_issue

Re: IPv6 subnet as search parameter does not work (but IPv4 does!)

npichugin — Fri, 09 Aug 2013 09:53:52 GMT

Thank you very much! I'll file this issue there.

Re: IPv6 subnet as search parameter does not work (but IPv4 does!)

_d_ — Sun, 25 Aug 2013 01:33:56 GMT

While lookups and the cidrmatch function work with IPv6 CIDR notation, a direct search (similar to your first one with IPv4) does not. It is a known internal requirement that will be tentatively solved in a future release.

Re: IPv6 subnet as search parameter does not work (but IPv4 does!)

npichugin — Mon, 26 Aug 2013 06:23:36 GMT

Thanks for clarifying!