Matching rex-defined fields against a csv file containing subnets

[sthomas]

Hi,

I've RTFM many times but can't seem to figure this out.. I am creating a new field ("ip") based on a simple search for Servers requesting an IP via DHCP:

DHCPREQUEST for" | rex field=_raw "DHCPREQUEST for (?ip\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)"

this returns a few thousand lines and polulates the field "ip".

Now I create a networks.csv in the following format:

network
123.123.123.0/24
123.123.124.0/24
123.123.125.0/24

I am trying to only display hosts that match one of the networks in the .csv file:

"DHCPREQUEST for" | rex field=_raw "DHCPREQUEST for (?ip\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)" | where cidrmatch("[|inputcsv networks.csv | fields network]",ip)

which returns zero results. Running only the subsearch returns the list of networks as expected.

What am I doing wrong?

[Ayn · Accepted solution]

You supply cidrmatch with a string, "[|inputcsv networks.csv | fields network]". cidrmatch doesn't find your IP in that string. So to be clear, that will NOT interpreted as a subsearch. Even if it did, it wouldn't work unfortunately - the default output from a subsearch is formatted to be understood by the search command. You could reformat it, but it wouldn't help since cidrmatch takes one subnet to match an IP against, not multiple subnets.

My suggestion is that, because the search command itself handles CIDR matching just fine, you could just use your subsearch with that instead.

"DHCPREQUEST for" | rex field=_raw "DHCPREQUEST for (?<ip>\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)" | search [|inputcsv networks.csv | rename network as ip | fields ip]

This should expand to something like:

... | search ((ip="123.123.123.0/24") OR (ip="123.123.124.0/24") OR (ip="123.123.125.0/24"))

which is a format that the search command understands.

[Ayn]

You can see exactly what a search will return if run as a subsearch by just running it on its own and appending ´| formatat the end. Theformat` command is run implicitly by subsearches.

[sthomas]

This works, thanks. I wasnt aware of the different formatting within a subsearch. Not having to use cidrmatch makes it a lot easier too. ty!