Splunk Search

How to read a file and use the data inside in a eval function?

langanix
New Member

I am new using Splunk, sorry.
I need to separate a lot of subnets by name. I would like (txt) to read a file kind of:

10.0.1.0/16 NAME1
10.5.0.0/24 NAME2
...

I am using this search now : | eval org=case(cidrmatch("10.118.68.0/23",src),"NAME1", cidrmatch("10.118.103.0/26",src_ip),"NAME2") | stats by org

The question is that I have a lot of subnets and I need to simplify the query, and I wonder if is there any way to read a file in the eval function, using awk or something like that?

Thanks in advance.

0 Karma
1 Solution

somesoni2
Revered Legend

What you need is to create a lookup table file with all those CIDR and name mapping, create a lookup transform to do cidr match. They you should be able to use lookup command to match and fetch name OR you can setup automatic lookup to get the name automatically. See this link for details.

https://answers.splunk.com/answers/5916/using-cidr-in-a-lookup-table.html

View solution in original post

0 Karma

somesoni2
Revered Legend

What you need is to create a lookup table file with all those CIDR and name mapping, create a lookup transform to do cidr match. They you should be able to use lookup command to match and fetch name OR you can setup automatic lookup to get the name automatically. See this link for details.

https://answers.splunk.com/answers/5916/using-cidr-in-a-lookup-table.html

0 Karma

langanix
New Member

Thank you very much for you answer!

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...