Dashboards & Visualizations

loop search for ranges mapping


Hi all,

While mapping ip-addresses to cities using iplocation or geoip commands, they returned just 65% of matched ip+cities. There's another geoip database that have more full information concerning my region.
Ip-addresses there are grouped in ranges that are converted into numeric format (ip address a.b.c.d is converted this way: a*256*256*256+b*256*256+c*256+d) :

city    range                      range_start  range_end   region
city1 -    37486592     37552127    region1 
city2 -    37552128     37617663    region2
city3 -    37617664     37683199    region3

csv file of 38k lines

And file with 700k ip-s that is needed to be matched with cities above, looks like this:

ip_address  ip_converted    37486592    37552128    37617664

Each ip_converted value shoud be checked against all ranges to find one where this statement is true:

range_start <= ip_converted <= range_end 

How can this matching be done in splunk? I've tried map but it's not for this case.

Thanks in advance!

Tags (2)
0 Karma


To do that math in Splunk, just add something like ...

...| rex field=clientip "(?<octet1>\d{1,3}).(?<octet2>\d{1,3}).(?<octet3>\d{1,3}).(?<octet4>\d{1,3})" |eval ip_decimal=(octet1*16777216)+(octet2*65536)+(octet3*256)+octet4

to the search. Obviously fix "clientip" to your IP field. This will create a field "ip_decimal" which will match your ranges.

0 Karma


You could put CIDR ranges into your CSV file, e.g. for the first line, for the second line, and so on. Using that column, Splunk can match individual IPs against that list of CIDR ranges and enrich the events with the other columns from that lookup. See http://answers.splunk.com/answers/5916/using-cidr-in-a-lookup-table/46866 for an example.

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...