Lookup in range value

[gavintofly]

Can I use lookup in a range value situation ? For example, the IP address:
10.0.1.0/24 for A area
10.0.2.0/24 for B area
when I input a single ip 10.0.1.2 in search bar，the lookup command will return A area.
If this can be done,how to configure it in splunk?

[rtadams89]

You want to have a lookup table such as:

IPRange, Area
10.0.1.0/24, A
10.0.2.0/24, B

Then when an event has a field ip=10.0.1.2, add area=A onto the event. I can think of a few ways to do this, not sure which is best based on the specifics of yoru situation.

1) Change the lookup table to include every IP address and its Area. So instead of 10.0.1.0/24, include 10.0.1.1, 10.0.1.2, 10.0.1.3, .... in the table.

2) Break the IP address up into 4 sections, and then compare the third section with a lookup table to determine what area the IP is in. So "1"=A, "2"=B, ....

3) Use "cidrmatch" in your search string to classify IPs instead of usign a lookup table at all.

3) Use "cidrmatch" in your string to add an additional field to each event that has the range the IP is in as the value. So if the ip is 10.0.1.2, use cidrmatch to add a field/value pair cidr="10.0.1.0/24". Then do the lookup on the field cidr.