Splunk Search

How to use the cidrmatch() function with IPV6 IP addresses?

fdi01
Motivator

The cidrmatch() function is used to identify IP addresses that belong to a particular subnet. How do I use it with IPV6 IP addresses? Syntax?

thanks

Tags (4)
1 Solution

stephanefotso
Motivator

Hello! I Firs i suggest that you follow this doc: https://blog.icann.org/wp-content/uploads/2010/07/ipv6-address-types.pdf
Then, for example to use the cidrmatch() for 2001:0000:4136:e378:8000:63bf:3fff:fdd2 address, you can just do something like this:

........... | eval network=if(cidrmatch("2001:0000::/32",clientip), "local", "other")

which compare the IP addresses in the clientip field to a subnet range, and give the value local to the network if the value of clientip falls in the subnet range, Otherwise, network=other.

SGF

View solution in original post

stephanefotso
Motivator

Hello! I Firs i suggest that you follow this doc: https://blog.icann.org/wp-content/uploads/2010/07/ipv6-address-types.pdf
Then, for example to use the cidrmatch() for 2001:0000:4136:e378:8000:63bf:3fff:fdd2 address, you can just do something like this:

........... | eval network=if(cidrmatch("2001:0000::/32",clientip), "local", "other")

which compare the IP addresses in the clientip field to a subnet range, and give the value local to the network if the value of clientip falls in the subnet range, Otherwise, network=other.

SGF

fdi01
Motivator

thank you but does not work .
i try like that:
| eval network=if(cidrmatch("2001:0000::/32",2001:0000:4136:e378:8000:63bf:3fff:fdd2), "local", "other")
but no isue. and i have this error:
Error in 'eval' command: The expression is malformed. Expected ).

0 Karma

stephanefotso
Motivator

you don't need to test like this. My query suppose that you have a field named clientip, with IPV6 IP addresses in your events. To test with a value of clientip try this:

  your base search  | eval network=if(cidrmatch("2001:0000::/32","2001:0000:4136:e378:8000:63bf:3fff:fdd2"), "local", "other")

I think it will work

SGF

fdi01
Motivator

it work fine Mr stephanefotso is it cool

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...