Splunk Search

How to ignore cidr from a lookup file in a search?

stephen123
Path Finder

Hi,

I have a large list of IP ranges in a lookup file. I want to ignore these in a search.

I can do the following for one specific IP range which works:

index=uk |where not cidrmatch("1.2.3.0/24",remote_ip)  | top remote_ip  

but I am struggling to get it to work with a lookup. I think I need to replace the IP with a subsearch doing the lookup from the file such as

index=uk |where not cidrmatch([search inputlookup ips |fields cidr],remote_ip)  | top remote_ip   

where the lookup definition is called ips and the only field is called cidr, but this doesn’t work.

0 Karma
1 Solution

woodcock
Esteemed Legend

I believe you are trying to do this, right?

http://answers.splunk.com/answers/5916/using-cidr-in-a-lookup-table.html

The trick is that you will have to have some other field in the lookup to trigger your NOT logic. Let us say the field is called Matched (it doesn't matter what the value is, so long as it is non-null, but you would probably always set it to Y), then you search like this:

index=uk |where isnull(Matched)

The idea is that your IP passed through the lookup but did not match any CIDR so the Matched field did not get created. Only get those.

View solution in original post

woodcock
Esteemed Legend

I believe you are trying to do this, right?

http://answers.splunk.com/answers/5916/using-cidr-in-a-lookup-table.html

The trick is that you will have to have some other field in the lookup to trigger your NOT logic. Let us say the field is called Matched (it doesn't matter what the value is, so long as it is non-null, but you would probably always set it to Y), then you search like this:

index=uk |where isnull(Matched)

The idea is that your IP passed through the lookup but did not match any CIDR so the Matched field did not get created. Only get those.

stephen123
Path Finder

I see what you are talking about re logic and have added another field to the file with Y

unfortunately I just have standard user access and do not have admin privileges and can not log onto the server to edit conf files etc, which appears to be a requirement of the solutions provided in the link.

0 Karma

woodcock
Esteemed Legend

All of this can be done through the GUI, too (you will have to click Advanced Options in many places). Do you have privileges to do Settings -> Fields -> Field Extractions -> New? If so, you can do it through the GUI instead of accessing the files directly.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...