Splunk Search

How to filter out IPv6 and 169.254.0.0/16 from a multi-value field?

mag314
Explorer

How do you filter out IPv6 and internal routed 169.254.0.0/16 from a multi-value field?

Data Example
HOST                    IP LIST
hostA                   10.0.0.3, 10.3.4.6, 169.254.1.5, fe80::2000:aff:fea7:f7c
hostB                   10.0.0.2, 192.168.3.12, 169.254.8.9, fe80::2000:aff:fea7:d3c

I have attempted using a number of combinations of mvfilter, match, cidrmatch and I can't get it to work.

| eval ip_list_filter_IPv6 = mvfilter(match(ip_list_orig, "/\b(?:(?:2(?:[0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9])\.){3}(?:(?:2([0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9]))\b")
| eval ip_list_filter_169 = mvfilter(match(ip_list_filter_IPv6, NOT cidrmatch(169.254.0.0/16,ip_list_filter_IPv6))

I thought cidrmatch might do it all but I believe it is not a validation macro but one that checks if an IP is in a given range.

 

Thanks for your help.

Labels (2)
0 Karma

yeahnah
Motivator

Hi @mag314 

I suggest you split and mvexpand the IP LIST field (note, I've used IP_LIST to avoid quoting so change as necessary), then filter with a where clause, like this 

| makeresults
| eval _raw="HOST IP_LIST
hostA 10.0.0.3, 10.3.4.6, 169.254.1.5, fe80::2000:aff:fea7:f7c
hostB 10.0.0.2, 192.168.3.12, 169.254.8.9, fe80::2000:aff:fea7:d3c"
| multikv
| table HOST IP_LIST
``` ^^^ ignore above - just creating dummy events ^^^ ```
``` add the following SPL ```
| eval IP_LIST=split(IP_LIST, ", ") ``` make IP_LIST a multivalue field ```
| mvexpand IP_LIST
| where cidrmatch("fe80:2000::/16",IP_LIST) OR cidrmatch("169.254.0.0/16", IP_LIST)
``` and if you want to reformat the event to look as before, then ... ```
| stats values(IP_LIST) AS IP_LIST BY HOST
| eval IP_LIST=mvjoin(IP_LIST, ", ")

yeahnah_0-1679624540401.png

Note, this answer may have some useful info on IPv6 and cidr matching

Solved: How to use the cidrmatch() function with IPV6 IP a... - Splunk Community

Hope it helps

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...