Splunk Search

Comparison with lookup cidrmatch?

bosseres
Contributor

Hello everyone, 

I got several fields in search result (name, ip_src). Now I have lookup with 2 columns:

name subnet
name1

10.10.10.1/24

name2

10.20.10.1/24

name3

10.20.10.1/24

 

I need firstly find by name corresponding subnet (for example I got in search result "name1" in field name, there is subnet 10.10.10.1/24) and next compare if src_ip of this name matches subnet.

Thank you for your help in advance

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can lookup a name in the lookup file and get the subnet back by using the lookup command.

<<your search>>
| lookup mylookup.csv name OUTPUT subnet

Test if a given field matches the subnet by using the cidrmatch function.

| eval match=if(cidrmatch(subnet, src_ip), "match", "nomatch")

 

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You can lookup a name in the lookup file and get the subnet back by using the lookup command.

<<your search>>
| lookup mylookup.csv name OUTPUT subnet

Test if a given field matches the subnet by using the cidrmatch function.

| eval match=if(cidrmatch(subnet, src_ip), "match", "nomatch")

 

 

---
If this reply helps you, Karma would be appreciated.

bosseres
Contributor

thank you, very much

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...