Hi,
I'm new to creating custom search commands, and haven't been able to understand the examples in the SDK repo on GitHub, if someone can point me to or provide a step by step guide to achieve the below that'd be really appreciated.
Problem: I need to filter my results to only include events where a field (cidr) is a subnet of a range entered on a dashboard ($search_cidr$).
As the builtin cidrmatch(CIDR, IP) only works with an IP and a CIDR range, I don't beleive I can do this natively, so I'm thinking a custom where command is the way to go, so I can do something like this in SPL:
| from datamodel:mymodel
| where SubnetOf(cidr, "$search_cidr$")
I've written a basic Python function in my apps bin directory to do the comparison, it takes either (IP, Subnet) or (Subnet. Subnet) and returns a boolean, however I don't know how to turn this into a filter for the where command to use.
#!/usr/bin/env python3
from ipaddress import ip_network
def SubnetOf(Needle, Haystack):
try:
Needle = ip_network(Needle)
Haystack = ip_network(Haystack)
return Needle.subnet_of(Haystack)
except:
return False
Any guidance to get me started would be great.
AFAIK, the where command is not extensible. You can do the equivalent with a custom command, though.
| from datamodel:mymodel
| SubnetOf needle=cidr haystack="$search_cidr$" result=foo
| where foo
You'll need to convert your script into a Splunk streaming command, though. See dev.splunk.com for more.
AFAIK, the where command is not extensible. You can do the equivalent with a custom command, though.
| from datamodel:mymodel
| SubnetOf needle=cidr haystack="$search_cidr$" result=foo
| where foo
You'll need to convert your script into a Splunk streaming command, though. See dev.splunk.com for more.