How to Join IP with CIDR?

[kiran331]

Hi

I'm trying to Compare the IP with CIDR Lookup to get the result.In the Lookup i got the CIDR range, City, manager.

Data in lookup:

IP Country Manager
10.21.22.23/24 US abc

Search I'm using:

index=.....|table dest_ip|join type=left dest_ip[|inputlookup range.csv|rename IP as dest_ip]|table dest_ip city Manager

[sundareshr]

Look at this answer. Setup match_type = CIDR(IP) in the transforms for your lookup file

https://answers.splunk.com/answers/5916/using-cidr-in-a-lookup-table.html

[kiran331]

Thanks for the response! I added this to transforms.conf.
[range]
filename = range.csv
max_matches = 1
min_matches = 1
default_match = OK
match_type = CIDR(IP)

But when i try to search, its showing errors.

search:
index=...|lookup range IP as dest_Ip OUTPUT Manager|table dest_ip Manager

[niddhi]

I also have the same settings in transform.conf, but its not matching the results. What am i missing here? Any pointers are appreciated.

Thanks,