How to map IP addresses to groups?

New Member

Hi all,

Splunk Newbie here. I am trying to map IP Addresses to Groups. I have SRC_IP, DEST_IP fields in my csv input. For instance, if I have as source and as a destination. I wanted to add fields in my table to say1.1.1.0/24 CIDRand maps to group Printers and2.2.2.0/24` to group PCs, for example.

I have been looking at the cidrmatch and lookup table, are these the right approaches? Any suggestions?

My input is a csv includes source and destination IP and port numbers. Thank you in advance.


0 Karma


You should use a cidr match lookup table.

Note when using match type CIDR your IP column whatever you call it must be in slash CIDR notation.

0 Karma