IP Range Lookup

[splunkrocks2014]

I have IP lookup table (ips.csv) mixed with different types of formats such as

ip
-----------------------
192.168.1.0/24
192.168.2.0-192.168.2.36
192.168.3.3

From transforms.conf, I defined a ip_lookup object as the following:

 [ip_lookup]
 filename = ips.csv
 match_type = CIDR(ip)

Does my lookup work with single IP or a IP range like this, 192.168.2.0-192.168.2.36?

Thanks.

[adonio]

can you elaborate? what is the problem you are trying to solve?

[splunkrocks2014]

I got the answer from starcher. Thank you for asking.

[starcher · Accepted solution]

cidr lookups have to be in /mask format. if the line is a single IP it should be 192.168.3.3/32

[splunkrocks2014]

Thank you starcher. This is what I am looking for.