Lookup in range value

gavintofly — Mon, 11 Jul 2011 08:46:38 GMT

Can I use lookup in a range value situation ? For example, the IP address:
10.0.1.0/24 for A area
10.0.2.0/24 for B area
when I input a single ip 10.0.1.2 in search bar，the lookup command will return A area.
If this can be done,how to configure it in splunk?

Re: Lookup in range value

rtadams89 — Fri, 09 Dec 2011 16:18:59 GMT

You want to have a lookup table such as:

IPRange, Area
10.0.1.0/24, A
10.0.2.0/24, B

Then when an event has a field ip=10.0.1.2, add area=A onto the event. I can think of a few ways to do this, not sure which is best based on the specifics of yoru situation.

1) Change the lookup table to include every IP address and its Area. So instead of 10.0.1.0/24, include 10.0.1.1, 10.0.1.2, 10.0.1.3, .... in the table.

2) Break the IP address up into 4 sections, and then compare the third section with a lookup table to determine what area the IP is in. So "1"=A, "2"=B, ....

3) Use "cidrmatch" in your search string to classify IPs instead of usign a lookup table at all.

3) Use "cidrmatch" in your string to add an additional field to each event that has the range the IP is in as the value. So if the ip is 10.0.1.2, use cidrmatch to add a field/value pair cidr="10.0.1.0/24". Then do the lookup on the field cidr.

topic Re: Lookup in range value in Splunk Search

Lookup in range value

Re: Lookup in range value