Splunk Enterprise

Why unexpected behavior using asset_lookup_by_cidr?

mc555
Loves-to-Learn

We use an asset file correctly configured on ES but we noticed that the enrichment based on "asset_lookup_by_cidr" is not working correctly because the lookup is not sorted by CIDR class. For example in the following sample the sorting is base on "lexicographic" order instead of the real CIDR classes logic:

1.2.30.0/26
1.2.30.128/25
1.2.31.0/24
1.2.32.0/24
1.2.33.0/25
1.2.33.128/25

We tried to solve the problem creating a saved search that automatically performs the right sort but soon after the execution the lookup "asset_lookup_by_cidr" is replaced with "lexicographic" order.

My saved search:

| inputlookup asset_lookup_by_cidr
| eval ip=replace(ip,"\s+","")
| eval sorted=case(match(ip,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{2}"),substr(ip,-2),match(ip,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1}"),substr(ip,-1),1=1,"0")
| sort limit=0 - sorted
| fields - sorted
| outputlookup asset_lookup_by_cidr

Is there a quick solution to this problem? Because it is a big trouble for notable based on IP addresses.

Labels (1)
0 Karma

mc555
Loves-to-Learn

After trying many possibilities, I eventually ran the reset collections in asset and identity management section. It’s the first time I ever run this task, and it seems it solved the problem completely.

Is reset collections something that I have to plan to execute periodically or according to some change that I make on the asset lookups?  

Are there any side effects in performing this task that I should be aware of?

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...