Splunk Enterprise

Why unexpected behavior using asset_lookup_by_cidr?

mc555
Loves-to-Learn

We use an asset file correctly configured on ES but we noticed that the enrichment based on "asset_lookup_by_cidr" is not working correctly because the lookup is not sorted by CIDR class. For example in the following sample the sorting is base on "lexicographic" order instead of the real CIDR classes logic:

1.2.30.0/26
1.2.30.128/25
1.2.31.0/24
1.2.32.0/24
1.2.33.0/25
1.2.33.128/25

We tried to solve the problem creating a saved search that automatically performs the right sort but soon after the execution the lookup "asset_lookup_by_cidr" is replaced with "lexicographic" order.

My saved search:

| inputlookup asset_lookup_by_cidr
| eval ip=replace(ip,"\s+","")
| eval sorted=case(match(ip,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{2}"),substr(ip,-2),match(ip,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1}"),substr(ip,-1),1=1,"0")
| sort limit=0 - sorted
| fields - sorted
| outputlookup asset_lookup_by_cidr

Is there a quick solution to this problem? Because it is a big trouble for notable based on IP addresses.

Labels (1)
0 Karma

mc555
Loves-to-Learn

After trying many possibilities, I eventually ran the reset collections in asset and identity management section. It’s the first time I ever run this task, and it seems it solved the problem completely.

Is reset collections something that I have to plan to execute periodically or according to some change that I make on the asset lookups?  

Are there any side effects in performing this task that I should be aware of?

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...