Knowledge Management

Create a wildcard string from cidr values for TERM matching

Motivator

Create a wildcard string for a TERM match to a cidr or list of cidrs.

This way you can search indexes or datamodels like this: index=myindex TERM(192.168.0.*) from the cidr 192.168.0.0/24

Labels (1)
Tags (1)
0 Karma
1 Solution

Motivator

The following macro displays the wildcard string matches to a given CIDR:

 rex field=cidr "^(?<ip_base>[\d\.]{7,})\/(?<ip_block>\d{1,2})$"
| rex field=ip_base "(?<ip1>\d+)\.(?<ip2>\d+)\.(?<ip3>\d+)"
| eval ip2B=case(ip_block<=8,"*",ip_block=16,ip2,ip_block=15,mvrange(ip2,ip2+2),ip_block=14,mvrange(ip2,ip2+4),ip_block=13,mvrange(ip2,ip2+8),ip_block=12,mvrange(ip2,ip2+16),ip_block=11,mvrange(ip2,ip2+32),ip_block=10,mvrange(ip2,ip2+64),ip_block=9,mvrange(ip2,ip2+128),1=1,ip2)
| eval ip3B=case(ip_block<=16,"*",ip_block=16,ip3,ip_block=23,mvrange(ip3,ip3+2),ip_block=22,mvrange(ip3,ip3+4),ip_block=21,mvrange(ip3,ip3+8),ip_block=20,mvrange(ip3,ip3+16),ip_block=19,mvrange(ip3,ip3+32),ip_block=18,mvrange(ip3,ip3+64),ip_block=17,mvrange(ip3,ip3+128),1=1,ip3)
| mvexpand ip2B
| mvexpand ip3B
| eval ip_wildcard=ip1.".".ip2B.".".ip3B.".*"
| fields - ip1* ip2* ip3* cidr_wildcard

View solution in original post

0 Karma

Motivator

The following macro displays the wildcard string matches to a given CIDR:

 rex field=cidr "^(?<ip_base>[\d\.]{7,})\/(?<ip_block>\d{1,2})$"
| rex field=ip_base "(?<ip1>\d+)\.(?<ip2>\d+)\.(?<ip3>\d+)"
| eval ip2B=case(ip_block<=8,"*",ip_block=16,ip2,ip_block=15,mvrange(ip2,ip2+2),ip_block=14,mvrange(ip2,ip2+4),ip_block=13,mvrange(ip2,ip2+8),ip_block=12,mvrange(ip2,ip2+16),ip_block=11,mvrange(ip2,ip2+32),ip_block=10,mvrange(ip2,ip2+64),ip_block=9,mvrange(ip2,ip2+128),1=1,ip2)
| eval ip3B=case(ip_block<=16,"*",ip_block=16,ip3,ip_block=23,mvrange(ip3,ip3+2),ip_block=22,mvrange(ip3,ip3+4),ip_block=21,mvrange(ip3,ip3+8),ip_block=20,mvrange(ip3,ip3+16),ip_block=19,mvrange(ip3,ip3+32),ip_block=18,mvrange(ip3,ip3+64),ip_block=17,mvrange(ip3,ip3+128),1=1,ip3)
| mvexpand ip2B
| mvexpand ip3B
| eval ip_wildcard=ip1.".".ip2B.".".ip3B.".*"
| fields - ip1* ip2* ip3* cidr_wildcard

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!