Splunk Search

How to search with cidrmatch with multiple subnets?

bosseres
Contributor

Hello everyone,

I got such table after search

 

ip subnets
10.0.0.2

10.0.0.0/24

 

10.0.0.3

10.0.0.0/24

172.24.23.23/24

 

I want to compare if ip belongs to subnets, using next one comparison

| eval match=if(cidrmatch(subnets, ip), "match", "nomatch")

It works correct if there is one subnet, but if more - not, how can I correct my search query?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| mvexpand subnets
| stats values(eval(if(cidrmatch(subnets, ip), subnets, null()))) as matches by ip

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

If subnets is a multi-value field, use mvexpand before the eval, otherwise use split to create a multi-value field and mvexpand.

bosseres
Contributor

Yes, I have multivalue field, I did


| mvexpand subnets

but how to make comparison, if ip belongs TO ONE of this subnets - then alert?

because now it checks the compliance of each ip with each subnet, for my example table 

ipsubnets
10.0.0.2

10.0.0.0/24

 

10.0.0.3

10.0.0.0/24

172.24.23.23/24

 

search will find 10.0.0.3 which not matches 172.24.23.23/24, but I need make search where if 10.0.0.3 matches even one of subnets

0 Karma

bosseres
Contributor

I mean I want to do, if ip matches at least one of subnets - then field match=match

Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

This is confusing as @ITWhisperer already explained you could use mvexpand.  Can you explain why this does not give you what you need?

| mvexpand subnets
| where cidrmatch(subnets, ip)

Suppose there are multiple subnets in the original table and ip matches one of them.  Is there any use of the non-matching subnets?

If there is any such use, ITWhisperer's last response covers it.

 

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| mvexpand subnets
| stats values(eval(if(cidrmatch(subnets, ip), subnets, null()))) as matches by ip

bosseres
Contributor

thank you, sir!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...