How to match match IP addresses with a lookup table that only contains IP subnets?

[phudinhha]

Dear Team,

What i am trying to achieve is like this:
I have a lookup table with many subnets. I am trying to match the destination host IP with the suitable subnet from the table.

| index dhcp
| lookup IPtable ip as dest_host OUTPUT ip as dest_match

The problem is the IP column in IPtable contains IP subnet only. How do I solve it?

Any help would be much appreciated!

[sundareshr]

See if this helps you

https://answers.splunk.com/answers/305211/how-to-match-an-ip-address-from-a-lookup-table-of.html

[MuS]

Hi phudinhha,

you're lookup for the match_type = CIDR() http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Addfieldmatchingrulestoyourlookupconfigu... in transforms.conf. See this example https://answers.splunk.com/answers/305211/how-to-match-an-ip-address-from-a-lookup-table-of.html

Hope this helps ...

cheers, MuS

[phudinhha]

Hi Mus and sundareshr

The problem is i don't have access to transforms.conf file, and i would like to compare the dest_host field with the IP column which contains subnet from the lookup table.

[MuS]

This will be tricky since you need at add some eval and use searchmatch to compare it ..... let me think about it

Much easier option, get someone with access to transforms.conf make the change and everyone can benefit from it!