Splunk Enterprise

Why unexpected behavior using asset_lookup_by_cidr?

mc555
Loves-to-Learn

We use an asset file correctly configured on ES but we noticed that the enrichment based on "asset_lookup_by_cidr" is not working correctly because the lookup is not sorted by CIDR class. For example in the following sample the sorting is base on "lexicographic" order instead of the real CIDR classes logic:

1.2.30.0/26
1.2.30.128/25
1.2.31.0/24
1.2.32.0/24
1.2.33.0/25
1.2.33.128/25

We tried to solve the problem creating a saved search that automatically performs the right sort but soon after the execution the lookup "asset_lookup_by_cidr" is replaced with "lexicographic" order.

My saved search:

| inputlookup asset_lookup_by_cidr
| eval ip=replace(ip,"\s+","")
| eval sorted=case(match(ip,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{2}"),substr(ip,-2),match(ip,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1}"),substr(ip,-1),1=1,"0")
| sort limit=0 - sorted
| fields - sorted
| outputlookup asset_lookup_by_cidr

Is there a quick solution to this problem? Because it is a big trouble for notable based on IP addresses.

Labels (1)
0 Karma

mc555
Loves-to-Learn

After trying many possibilities, I eventually ran the reset collections in asset and identity management section. It’s the first time I ever run this task, and it seems it solved the problem completely.

Is reset collections something that I have to plan to execute periodically or according to some change that I make on the asset lookups?  

Are there any side effects in performing this task that I should be aware of?

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...