Splunk Search
Highlighted

How to match match IP addresses with a lookup table that only contains IP subnets?

Loves-to-Learn

Dear Team,

What i am trying to achieve is like this:
I have a lookup table with many subnets. I am trying to match the destination host IP with the suitable subnet from the table.

| index dhcp
| lookup IPtable ip as dest_host OUTPUT ip as dest_match

The problem is the IP column in IPtable contains IP subnet only. How do I solve it?

Any help would be much appreciated!

0 Karma
Highlighted

Re: How to match match IP addresses with a lookup table that only contains IP subnets?

SplunkTrust
SplunkTrust
0 Karma
Highlighted

Re: How to match match IP addresses with a lookup table that only contains IP subnets?

Loves-to-Learn

Hi Mus and sundareshr

The problem is i don't have access to transforms.conf file, and i would like to compare the dest_host field with the IP column which contains subnet from the lookup table.

0 Karma
Highlighted

Re: How to match match IP addresses with a lookup table that only contains IP subnets?

SplunkTrust
SplunkTrust

This will be tricky since you need at add some eval and use searchmatch to compare it ..... let me think about it

Much easier option, get someone with access to transforms.conf make the change and everyone can benefit from it!

0 Karma
Highlighted

Re: How to match match IP addresses with a lookup table that only contains IP subnets?

Legend
0 Karma