Splunk Search

Lookup with IP range

MoermansM
New Member

Hi there, what's the best way to append a search with a lookup with ip subnet ranges and some extra information for those IP's?

iprange.csv

 clientip, zone, areacode
127.0.0.1/24, home, 255

I've added the transforms.conf in the app:

[iprange]
filename = iprange.csv
default_match = OK
match_type = CIDR(clientip)

and the search:

 sourcetype=firewall area=* | lookup iprange.csv clientip as src OUTPUT clientip zone area |table src, zone, area

Yet it doesn't seem to work so far, any suggestions?

0 Karma

niddhi
Explorer

I have exactly the same scenario and its not working. I don't want to add the ip's manually as src, that will defeat the purpose of having a dynamic lookup. Any pointers are appreciated.

0 Karma

anjambha
Communicator

Hi MoermansM,

You are not getting output because the ip you are getting from firewall is without subnet and your csv contain ip with subnet so can not map the column.

So in this case the alternative solution for this is to add one more column to your iprange.csv as below: if you are doing this modification then there is no need of transforms.conf.

src, clientip, zone, areacode
127.0.0.1, 127.0.0.1/24, home, 255

then try this ..

sourcetype=firewall area=* | dedup src | lookup iprange.csv src OUTPUT src clientip zone area |table src, clientip, zone, area
0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...