Splunk Search

CIDR in a lookup table - no access to transforms.conf?

Explorer

I know it's possible to put CIDR ip ranges in a lookup table. However, my question is, what if I do not have access to modify the transforms.conf file directly and match_type is now shown in the advanced area of the lookup definitions (I'm using 6.1). Is there a way to use something similar to match_type in a regular query search so I can acquire the same type of results even if it's not specified in the transforms.conf file?

New Member

Use the 'map' command. Here is an example:

Lets assume you have a lookup table called 'my_csv_list_of_cidr_ranges.csv ' which looks something like:

cidr
199.000.001.0/22
199.000.002.0/22
199.000.003.0/22

Or something like that.

The following code will take that list and compare it to a field called 'my_ip' and return a list of IP addresses that match at least one of the cidr ranges. The myfield* fields are optional and are simply there to pass other fields out of the map command. Be sure to set maxsearches to a value higher than the number of cidrs in you lookup file.

index=myindex sourcetype=mysource 
| map maxsearches=100 search="| inputlookup my_csv_list_of_cidr_ranges.csv 
| eval myfield1=\"$myfield1$\"
| eval myfield2=\"$myfield2$\"
| eval ipmatch=if(cidrmatch(cidr,my_ip),1,0)
| eventstats sum(ipmatch) as total_ipmatch by my_ip
| where total_ipmatch>0
| dedup my_ip
| table * "
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!