Splunk Search

Finding the correct scope of an IP address?

dersa
Path Finder

Hi, I am struggling with following task. I have a lookup file containing all the configured dhcp scopes in the following format. 

ScopeId SubnetMask Name State StartRange EndRange LeaseDuration

In the dhcp.log i have the ip address for a client. 

I need the ScopeID and the LeaseDuration for each client. 

My idea is to look if the given IP Address is within StartRange and EndRange and get the ScopeID and LeaseDuration. My problem is I don't have a clue on how to do so.

Any Ideas?

thanks 

Alex

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Are you IP ranges CIDR ranges, if so, you can make a lookup definition based on that CSV with the CIDR range as a single field in the lookup. In the match advanced options for the lookup definition, set CIDR(range_field) where range_field in the field containing the CIDR range.

Then in your SPL do

<search>
| lookup dhcp_scopes range_field as ip

which will lookup ip against the CIDR range in the lookup

If you cannot do CIDR, then it becomes a little more complicated. You will have to work out if you can segregate your lookup rows into stem+range for groups of IP addresses. e.g.

base=10.1.8, start=1, end=63
base=10.1.8, start=128, end=192
base=10.2.8, start=1, end=63

You'll then need to break up the IP to make a match and the possibly get multiple results back. It's possible but a little fiddly.

0 Karma

dersa
Path Finder

Thanks, 

I'll give it a shot.

Best regards

Alex

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...