All Apps and Add-ons

Transforms.conf not using match_type = CIDR(ip) when searching

mmqt
Path Finder

Leveraging the app ASN Lookup Generator - https://splunkbase.splunk.com/app/3531/ to build a lookup table for that has the following in a lookup table called 'asn'
asn

the transforms.conf file has the following - note I commented out max_matches to test, with or without that line commented it still wont return results

# cat TA-asngen/default/transforms.conf
[asn]
filename = asn.csv
match_type = CIDR(ip)
#max_matches = 1

If I run the following search

| makeresults |eval src="1.0.0.1"| lookup asn ip as src

Nothing is matched, but it should be matched to asn 1335, any thoughts? I feel like I'm doing something wrong

no match

0 Karma

mmqt
Path Finder

I needed to reboot the instance for it to recognize the input, after the reboot it worked

0 Karma

to4kawa
Ultra Champion

your query, lookup asn ,not asn.csv

0 Karma

mmqt
Path Finder

changing the query to asn.csv still does not provide any ip transformation.

0 Karma

to4kawa
Ultra Champion

link text

how's props.conf?

0 Karma

mmqt
Path Finder

No props as this is not intended to be an automatic lookup, this lookup is called on demand for any sourcetype that contains an IP.

Props would just remove the need to put in ip as src OUTPUTNEW asn

Which is not the problem I'm trying to solve

0 Karma

anmolpatel
Builder

did you run the below?

| extract reload=T
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...