Splunk Search

How to filter out IPv6 and from a multi-value field?


How do you filter out IPv6 and internal routed from a multi-value field?

Data Example
HOST                    IP LIST
hostA         ,,, fe80::2000:aff:fea7:f7c
hostB         ,,, fe80::2000:aff:fea7:d3c

I have attempted using a number of combinations of mvfilter, match, cidrmatch and I can't get it to work.

| eval ip_list_filter_IPv6 = mvfilter(match(ip_list_orig, "/\b(?:(?:2(?:[0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9])\.){3}(?:(?:2([0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9]))\b")
| eval ip_list_filter_169 = mvfilter(match(ip_list_filter_IPv6, NOT cidrmatch(,ip_list_filter_IPv6))

I thought cidrmatch might do it all but I believe it is not a validation macro but one that checks if an IP is in a given range.


Thanks for your help.

Labels (2)
0 Karma


Hi @mag314 

I suggest you split and mvexpand the IP LIST field (note, I've used IP_LIST to avoid quoting so change as necessary), then filter with a where clause, like this 

| makeresults
| eval _raw="HOST IP_LIST
hostA,,, fe80::2000:aff:fea7:f7c
hostB,,, fe80::2000:aff:fea7:d3c"
| multikv
| table HOST IP_LIST
``` ^^^ ignore above - just creating dummy events ^^^ ```
``` add the following SPL ```
| eval IP_LIST=split(IP_LIST, ", ") ``` make IP_LIST a multivalue field ```
| mvexpand IP_LIST
| where cidrmatch("fe80:2000::/16",IP_LIST) OR cidrmatch("", IP_LIST)
``` and if you want to reformat the event to look as before, then ... ```
| stats values(IP_LIST) AS IP_LIST BY HOST
| eval IP_LIST=mvjoin(IP_LIST, ", ")


Note, this answer may have some useful info on IPv6 and cidr matching

Solved: How to use the cidrmatch() function with IPV6 IP a... - Splunk Community

Hope it helps

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...