How to use the cidrmatch function in a search to get the ISP for an IP address using a lookup with cidr ip blocks?

[cdo_splunk]

I am trying to get the ISP for an IP address using a database with cidr ip blocks

The lookup file is "GeoIPISP.csv" with these columns
start_ip,end_ip,isp,cidr

The main search is something like
index="nginx" | top ip

I am trying to use cidrmatch, but it requires to cidr block as the first parameter.
How do I join them together to show the ISP?

[rsennett_splunk]

cidrmatch is a function for eval or where. You're not showing how you'd use it, but I think you might be misinterpreting the instructions.
the syntax is:
cidrmatch("X",Y)

the first parameter, X is the CIDR but the order of parameters has nothing to do with...anything else.

|eval mymatch=cidrmatch(cidr,ip)

So you would look em up, and then do the eval and whatever else you want.

But that's not what it seems you're looking for.
The definition in transforms.conf for the lookup needs:
match_type=CIDR

transforms.conf
[geoIPISP]
filename=GeoIPISP.csv
match_type=CIDR(isp)

index=nginx|[inputlookup geoIPISP |fields isp |rename isp AS ip]|top ip limit=1

The search example you have isn't looking at the lookup table.
So you use a sub search to grab the value and that's passed to the outer search. (and the rename normalizes the filenames)

[cdo_splunk]

I want to match an IP in the log file to an ISP defined in the GeoIPISP lookup.

so, assume If I run this search:
index="nginx" | top limit=1

it returns:
1.0.0.1
Also assume, GeoIPISP.csv has two lines:
start_ip,end_ip,isp,cidr
16777216,16777471,Google,1.0.0.0/24<http://1.0.0.0/24>

I want to look up that IP 1.0.0.1 is in the cidr block of 1.0.0.0/24<http://1.0.0.0/24>, which then returns the ISP Google.

From the info above, I think this will work

in transforms.conf:
[geoip_isp]
filename = GeoIPISP_cidr.csv
max_matches = 1
min_matches = 1
default_match = OK
match_type = CIDR(ip)

in props.conf
[nginx]
LOOKUP-geoip = geoip_isp ip OUTPUT start_ip end_ip isp

Then this search
index="nginx" | top isp limit=1

will return:
Google

is that right, or am I missing something?

[rsennett_splunk]

I've edited my answer now that the question is more clear.
Your example doesn't actually touch the lookup table at all... so I wasn't sure where you were going.