Splunk Enterprise Security

How to use ip_intel lookup to perform a CIDR match ?

neerajs_81
Builder

Hello Folks,
How can i perform a CIDR/Subnet match with the "ip_intel" lookup file that comes by default ?  This lookup KV store dataset has CIDR ranges and single IP's listed under "IP" column .

Basically if the Dest_IP from my search results fall in a subnet range of the "IP" column  of the lookup file , then it should display the result in a table format.  I am able to match against a single IP-address but not against CIDR  range.

How do you guys about this one ? Thanks in advance

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...