topic Re: How to match match IP addresses with a lookup table that only contains IP subnets? in Splunk Search

How to match match IP addresses with a lookup table that only contains IP subnets?

phudinhha — Thu, 04 Aug 2016 21:30:29 GMT

Dear Team,

What i am trying to achieve is like this:
I have a lookup table with many subnets. I am trying to match the destination host IP with the suitable subnet from the table.

| index dhcp
| lookup IPtable ip as dest_host OUTPUT ip as dest_match

The problem is the IP column in IPtable contains IP subnet only. How do I solve it?

Any help would be much appreciated!

Re: How to match match IP addresses with a lookup table that only contains IP subnets?

MuS — Thu, 04 Aug 2016 21:59:57 GMT

Hi phudinhha,

you're lookup for the match_type = CIDR() http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Addfieldmatchingrulestoyourlookupconfiguration in transforms.conf. See this example https://answers.splunk.com/answers/305211/how-to-match-an-ip-address-from-a-lookup-table-of.html

Hope this helps ...

cheers, MuS

Re: How to match match IP addresses with a lookup table that only contains IP subnets?

sundareshr — Thu, 04 Aug 2016 22:00:16 GMT

See if this helps you

https://answers.splunk.com/answers/305211/how-to-match-an-ip-address-from-a-lookup-table-of.html

Re: How to match match IP addresses with a lookup table that only contains IP subnets?

phudinhha — Thu, 04 Aug 2016 22:04:17 GMT

Hi Mus and sundareshr

The problem is i don't have access to transforms.conf file, and i would like to compare the dest_host field with the IP column which contains subnet from the lookup table.

Re: How to match match IP addresses with a lookup table that only contains IP subnets?

MuS — Thu, 04 Aug 2016 22:13:53 GMT

This will be tricky since you need at add some eval and use searchmatch to compare it ..... let me think about it

Much easier option, get someone with access to transforms.conf make the change and everyone can benefit from it!