Getting Data In

Using cidrmatch with a CSV file throws error.

ImanIself
Explorer

I am trying to match a list of CIDR ranges in a csv file to hosts that are going outbound on our network...basically trying to see if there are any naughty hosts trying to go to Russia. The search command is as follows:

sourcetype="cisco_syslog" | eval Fhost=cidrmatch([inputcsv rrcidrlist], cisco_dsthost)

When i run this the following error is returned: Error in 'eval' command: The number 46.19.104.0 is invalid.

The 46.19.104.0 just so happens to be the first IP in the list, however its doesn't appear to be reading the /21 at the end. Again, it doesn't appear to be reading the 46.19.104.0/21 CIDR range. There are no spaces in the CSV file. The documentation indicates that the double quotes should be used around the CIDR range however i have tried them everywhere and nothing seems to work. Any help would be greatly appreciated. Noobly appreciated 🙂

Tags (1)

hammon0u
Explorer

You can use the MAXMIND application to lookup IP against the MAXMIND db and report on anything that returns a lookup to Russia or China etc. You can even find the City in Russia where the packet went.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

The arguments to cidrmatch must be passed as strings, and therefore must be quoted. The results from your subsearch probably looks like:

( ( 46.19.104.0/21 ) )

or

( ( 46.19.104.0/21 ) OR ( 1.2.3.4/21 ) OR ... )

Anyway, the point is subsearch doesn't expand the way you think it does, and if you have multiple values, it is even less likely to work the way you think.

What you really need is:

sourcetype=ciso_syslog [ inputcsv rrcidrlist | fields iprange | rename iprange as cisco_dsthost ]

Which assumes that the fieldname in the CSV file that contains the CIDR ranges is iprange. If it isn't substitute appropriately.

gkanapathy
Splunk Employee
Splunk Employee

Yeah, so my example should do what you want.

0 Karma

ImanIself
Explorer

I appreciate the quick response. It appears i was going in the wrong direction. Basically I want to compare a CSV list of CIDR ranges to a field which contains hosts attempting to connect externally and return any matches. We want to see if any hosts are attempting to connect to Russia/Romania.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...