Knowledge Management

Set host tag (tag::host) based on CIDR search



Apologies in advance if there already is a similar question/answer (I couldn't find it)

Is there a way of setting tag::host (or some other tag, e.g. tag::client) based on a host search using cidr notation? I'd like to avoid using a lookup table specifying host per line (unless I can use cidr)


Tags (1)

Splunk Employee
Splunk Employee

You can use eventtypes for this. Eventtypes are fundamentally tags on events defined by a search. Create an eventtype with your CIDR criteria on the field as its search and your events will be tagged appropriately in the "eventtype" field.


You can use a scripted lookup - take a look at this thread for more detail:

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!