What i am trying to achieve is like this:
I have a lookup table with many subnets. I am trying to match the destination host IP with the suitable subnet from the table.
| index dhcp | lookup IPtable ip as dest_host OUTPUT ip as dest_match
The problem is the IP column in IPtable contains IP subnet only. How do I solve it?
Any help would be much appreciated!
you're lookup for the
match_type = CIDR() http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Addfieldmatchingrulestoyourlookupconfigu... in
transforms.conf. See this example https://answers.splunk.com/answers/305211/how-to-match-an-ip-address-from-a-lookup-table-of.html
Hope this helps ...
Hi Mus and sundareshr
The problem is i don't have access to transforms.conf file, and i would like to compare the dest_host field with the IP column which contains subnet from the lookup table.
This will be tricky since you need at add some
eval and use
searchmatch to compare it ..... let me think about it
Much easier option, get someone with access to
transforms.conf make the change and everyone can benefit from it!