Hi
I'm trying to Compare the IP with CIDR Lookup to get the result.In the Lookup i got the CIDR range, City, manager.
Data in lookup:
IP Country Manager
10.21.22.23/24 US abc
Search I'm using:
index=.....|table dest_ip|join type=left dest_ip[|inputlookup range.csv|rename IP as dest_ip]|table dest_ip city Manager
Look at this answer. Setup match_type = CIDR(IP)
in the transforms
for your lookup file
https://answers.splunk.com/answers/5916/using-cidr-in-a-lookup-table.html
Thanks for the response! I added this to transforms.conf.
[range]
filename = range.csv
max_matches = 1
min_matches = 1
default_match = OK
match_type = CIDR(IP)
But when i try to search, its showing errors.
search:
index=...|lookup range IP as dest_Ip OUTPUT Manager|table dest_ip Manager
I also have the same settings in transform.conf, but its not matching the results. What am i missing here? Any pointers are appreciated.
Thanks,