Splunk Search

How to filter out IPv6 and from a multi-value field?


How do you filter out IPv6 and internal routed from a multi-value field?

Data Example
HOST                    IP LIST
hostA         ,,, fe80::2000:aff:fea7:f7c
hostB         ,,, fe80::2000:aff:fea7:d3c

I have attempted using a number of combinations of mvfilter, match, cidrmatch and I can't get it to work.

| eval ip_list_filter_IPv6 = mvfilter(match(ip_list_orig, "/\b(?:(?:2(?:[0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9])\.){3}(?:(?:2([0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9]))\b")
| eval ip_list_filter_169 = mvfilter(match(ip_list_filter_IPv6, NOT cidrmatch(,ip_list_filter_IPv6))

I thought cidrmatch might do it all but I believe it is not a validation macro but one that checks if an IP is in a given range.


Thanks for your help.

Labels (2)
0 Karma


Hi @mag314 

I suggest you split and mvexpand the IP LIST field (note, I've used IP_LIST to avoid quoting so change as necessary), then filter with a where clause, like this 

| makeresults
| eval _raw="HOST IP_LIST
hostA,,, fe80::2000:aff:fea7:f7c
hostB,,, fe80::2000:aff:fea7:d3c"
| multikv
| table HOST IP_LIST
``` ^^^ ignore above - just creating dummy events ^^^ ```
``` add the following SPL ```
| eval IP_LIST=split(IP_LIST, ", ") ``` make IP_LIST a multivalue field ```
| mvexpand IP_LIST
| where cidrmatch("fe80:2000::/16",IP_LIST) OR cidrmatch("", IP_LIST)
``` and if you want to reformat the event to look as before, then ... ```
| stats values(IP_LIST) AS IP_LIST BY HOST
| eval IP_LIST=mvjoin(IP_LIST, ", ")


Note, this answer may have some useful info on IPv6 and cidr matching

Solved: How to use the cidrmatch() function with IPV6 IP a... - Splunk Community

Hope it helps

0 Karma
Get Updates on the Splunk Community!

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through: An introduction to the Splunk Threat ...