Splunk Search

How to create a field based on cidrmatch in Splunk 6.2?

lbogle
Contributor

Hello,

I am using Splunk 6.2 and I am trying to use |eval cidrmatch in a search to identify a series of subnets by a common name. I am using the following:

some search highlighting individual IP's by field clientIP | eval voipnet=cidrmatch("111.111.0.0/16",clientIP) | eval tecnet=cidrmatch("222.222.0.0/16",clientIP) | eval secnet=cidrmatch("333.333.0.0/16",clientIP) | table clientIP,clientSplunkName,clientNetworkName,voipnet,tecnet,secnet | dedup clientIP

But I keep getting the error:

Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr])

Based on the reference documentation, it looks like my search *may have worked in v.5. Any recommendations on how to do this in version 6.2?

Tags (3)
0 Karma
1 Solution

lloydd518
Path Finder

Hi there...

As per http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonEvalFunctions

Cidrmatch returns true or false and works well nested in an "if" statement

So in order to add knowledge to your data.. You could try

some search highlighting individual IP's by field clientIP | eval voipnet=if(cidrmatch("111.111.0.0/16",clientIP),client ip,"") | eval tecnet=if(cidrmatch("222.222.0.0/16",clientIP),client ip,"") | eval secnet=if(cidrmatch("333.333.0.0/16",clientIP),clientIP,"") | table clientIP,clientSplunkName,clientNetworkName,voipnet,tecnet,secnet | dedup clientIP

Each eval works if cidrmatch matches the clientIP again the iprange. It passes true to the if statement.
The if statement then makes sure that voipnet = clientIP because the result true was returned. If the cidrmatch returns false... Then voipnet is still created but is empty... You can still search voipnet= "". Your table should pull all results together. It's probably not the prettiest way to do this, there may even be a more efficient way. Hope this helps...

View solution in original post

lloydd518
Path Finder

Hi there...

As per http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonEvalFunctions

Cidrmatch returns true or false and works well nested in an "if" statement

So in order to add knowledge to your data.. You could try

some search highlighting individual IP's by field clientIP | eval voipnet=if(cidrmatch("111.111.0.0/16",clientIP),client ip,"") | eval tecnet=if(cidrmatch("222.222.0.0/16",clientIP),client ip,"") | eval secnet=if(cidrmatch("333.333.0.0/16",clientIP),clientIP,"") | table clientIP,clientSplunkName,clientNetworkName,voipnet,tecnet,secnet | dedup clientIP

Each eval works if cidrmatch matches the clientIP again the iprange. It passes true to the if statement.
The if statement then makes sure that voipnet = clientIP because the result true was returned. If the cidrmatch returns false... Then voipnet is still created but is empty... You can still search voipnet= "". Your table should pull all results together. It's probably not the prettiest way to do this, there may even be a more efficient way. Hope this helps...

lloydd518
Path Finder

A quick and dirty method would be to insert a filter before or after we table the results...

some search highlighting individual IP's by field clientIP | eval voipnet=if(cidrmatch("111.111.0.0/16",clientIP),client ip,"") | eval tecnet=if(cidrmatch("222.222.0.0/16",clientIP),client ip,"") | eval secnet=if(cidrmatch("333.333.0.0/16",clientIP),clientIP,"") | search voipnet!="" OR tecnet!="" OR secnet!="" | table clientIP,clientSplunkName,clientNetworkName,voipnet,tecnet,secnet | dedup clientIP

The filter ensures that results where all 3 fields are empty, are excluded from the final results.. Hopefully! 🙂

0 Karma

lbogle
Contributor

That seems to work! Great job!
Question though, the search returns results that are not categorized by either of the three eval functions. How do I get it to only show the items marked in the voipnet, secnet and tecnets?
Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...