topic Re: How to ignore cidr from a lookup file in a search? in Splunk Search

How to ignore cidr from a lookup file in a search?

stephen123 — Thu, 10 Sep 2015 11:35:05 GMT

Hi,

I have a large list of IP ranges in a lookup file. I want to ignore these in a search.

I can do the following for one specific IP range which works:

index=uk |where not cidrmatch("1.2.3.0/24",remote_ip)  | top remote_ip

but I am struggling to get it to work with a lookup. I think I need to replace the IP with a subsearch doing the lookup from the file such as

index=uk |where not cidrmatch([search inputlookup ips |fields cidr],remote_ip)  | top remote_ip

where the lookup definition is called ips and the only field is called cidr, but this doesn’t work.

Re: How to ignore cidr from a lookup file in a search?

woodcock — Thu, 10 Sep 2015 12:04:45 GMT

I believe you are trying to do this, right?

http://answers.splunk.com/answers/5916/using-cidr-in-a-lookup-table.html

The trick is that you will have to have some other field in the lookup to trigger your NOT logic. Let us say the field is called Matched (it doesn't matter what the value is, so long as it is non-null, but you would probably always set it to Y), then you search like this:

index=uk |where isnull(Matched)

The idea is that your IP passed through the lookup but did not match any CIDR so the Matched field did not get created. Only get those.

Re: How to ignore cidr from a lookup file in a search?

stephen123 — Thu, 10 Sep 2015 13:29:17 GMT

I see what you are talking about re logic and have added another field to the file with Y

unfortunately I just have standard user access and do not have admin privileges and can not log onto the server to edit conf files etc, which appears to be a requirement of the solutions provided in the link.

Re: How to ignore cidr from a lookup file in a search?

woodcock — Thu, 10 Sep 2015 13:46:51 GMT

All of this can be done through the GUI, too (you will have to click Advanced Options in many places). Do you have privileges to do Settings -> Fields -> Field Extractions -> New? If so, you can do it through the GUI instead of accessing the files directly.