Splunk Search

How to write a query to check IP addresses in Subnets?

POR160893
Builder

Hi,

I am trying to establish a query that checks whether a random src IP is in a specific subnet.

However, all the subnets and IP addresses are in String format and I am unable to establish any mathematical relationship between the conditions.

Here is a part of my current query:

| inputlookup ABC.csv
| eval ip = 10.1.2.342

| eval AMERICAS =if(ip >= 10.0.0.1 OR ip <= 10.63.255.254,"NOK","OK")

| table AMERICAS

 

Can you please help?

Many thanks as always,

Labels (5)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

I expecting that your ip is like "10.1.2.34" not "10.1.2.342" and you have e.g. subnets 10.0.0.0 - 10.63.255.255 defined for America. Then you can check it like

| eval ip = "10.1.2.34", subnet = "10.0.0.0/10"
| eval AMERICAS = if (cidrmatch(subnet,ip), "OK", "NOK")

If your subnets are not exactly dived by suitable masks, you need to add needed smaller subnets and combine this if with several OR clauses.

r. Ismo 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If your subnets are in CIDR format, you can use the cidrmatch() function

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...