How to filter out IPv6 and 169.254.0.0/16 from a multi-value field?

[mag314]

How do you filter out IPv6 and internal routed 169.254.0.0/16 from a multi-value field?

Data Example
HOST                    IP LIST
hostA                   10.0.0.3, 10.3.4.6, 169.254.1.5, fe80::2000:aff:fea7:f7c
hostB                   10.0.0.2, 192.168.3.12, 169.254.8.9, fe80::2000:aff:fea7:d3c

I have attempted using a number of combinations of mvfilter, match, cidrmatch and I can't get it to work.

| eval ip_list_filter_IPv6 = mvfilter(match(ip_list_orig, "/\b(?:(?:2(?:[0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9])\.){3}(?:(?:2([0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9]))\b")
| eval ip_list_filter_169 = mvfilter(match(ip_list_filter_IPv6, NOT cidrmatch(169.254.0.0/16,ip_list_filter_IPv6))

I thought cidrmatch might do it all but I believe it is not a validation macro but one that checks if an IP is in a given range.

Thanks for your help.

[yeahnah]

Hi @mag314 

I suggest you split and mvexpand the IP LIST field (note, I've used IP_LIST to avoid quoting so change as necessary), then filter with a where clause, like this 

| makeresults
| eval _raw="HOST IP_LIST
hostA 10.0.0.3, 10.3.4.6, 169.254.1.5, fe80::2000:aff:fea7:f7c
hostB 10.0.0.2, 192.168.3.12, 169.254.8.9, fe80::2000:aff:fea7:d3c"
| multikv
| table HOST IP_LIST
``` ^^^ ignore above - just creating dummy events ^^^ ```
``` add the following SPL ```
| eval IP_LIST=split(IP_LIST, ", ") ``` make IP_LIST a multivalue field ```
| mvexpand IP_LIST
| where cidrmatch("fe80:2000::/16",IP_LIST) OR cidrmatch("169.254.0.0/16", IP_LIST)
``` and if you want to reformat the event to look as before, then ... ```
| stats values(IP_LIST) AS IP_LIST BY HOST
| eval IP_LIST=mvjoin(IP_LIST, ", ")

Note, this answer may have some useful info on IPv6 and cidr matching

Solved: How to use the cidrmatch() function with IPV6 IP a... - Splunk Community

Hope it helps