How to convert IP groups to name.

[lakromani]

I have some data like this:

6/5/2014 2:03:57 PM 0ACC PACKET  00000000070FAEC0 UDP Snd 10.253.70.49    81c5 R Q [8381   DR NXDOMAIN] AAAA   (7)he12343(5)user(4)ld(2)uk(0)

I can get the IP to a field by using "field extraction" like this:

UPD Snd (?<client_ip>[^ ]*)

It will then show up like this client_ip=10.253.70.49

I would like to get a field with name location

It should be some like this location=london based on:

london
client_ip="10.253.70.0/23"

dublin
client_ip="10.253.72.0/23"

This way I can quick see where users are located.

[treinke]

The best way for this is to use lookup tables. Since they are internal ip addresses, you can create a csv file and then tell Splunk to reference that for the location.

Here is the documentation setting up lookups:
http://docs.splunk.com/Documentation/Splunk/6.1.1/Knowledge/Addfieldsfromexternaldatasources

[treinke]

Splunk does understand ip subnets so I would think so.

[lakromani]

Hi, and thanks for the answer. Will the csv file handle eks "10.253.70.0/23,London" (ragnges if IP) so that I do not need to add one and one IP. With millions IP, that wold take time.