How to use the cidrmatch() function with IPV6 IP addresses?

[fdi01]

The cidrmatch() function is used to identify IP addresses that belong to a particular subnet. How do I use it with IPV6 IP addresses? Syntax?

thanks

[stephanefotso · Accepted solution]

Hello! I Firs i suggest that you follow this doc: https://blog.icann.org/wp-content/uploads/2010/07/ipv6-address-types.pdf
Then, for example to use the cidrmatch() for 2001:0000:4136:e378:8000:63bf:3fff:fdd2 address, you can just do something like this:

........... | eval network=if(cidrmatch("2001:0000::/32",clientip), "local", "other")

which compare the IP addresses in the clientip field to a subnet range, and give the value local to the network if the value of clientip falls in the subnet range, Otherwise, network=other.

[fdi01]

thank you but does not work .
i try like that:
| eval network=if(cidrmatch("2001:0000::/32",2001:0000:4136:e378:8000:63bf:3fff:fdd2), "local", "other")
but no isue. and i have this error:
Error in 'eval' command: The expression is malformed. Expected ).

[stephanefotso]

you don't need to test like this. My query suppose that you have a field named clientip, with IPV6 IP addresses in your events. To test with a value of clientip try this:

  your base search  | eval network=if(cidrmatch("2001:0000::/32","2001:0000:4136:e378:8000:63bf:3fff:fdd2"), "local", "other")

I think it will work

[fdi01]

it work fine Mr stephanefotso is it cool