Match IP's in Splunk against IP ranges in decimal format in CSV

[spark2310]

I have a field in Splunk that contains IPs such as 223.xx.xxx.1
query: index=traffic_logs ip_address=*|timechart span=1h count by ip_address

I want to write a query to timechart ips traffic that match in one of the ranges in the csv file below (it had ip ranges in decimal format), so the ip above should return http://thegigabit.com since it exists in the range.

(( 3743019008, -----> this is actually 223.25.240.0 if converted to IP format
3743020031, -----> range end 223.25.243.255
'http://thetestbit.com/'),
( 3743020288,
3743021055,
'http://thetestbit.com/'),
( 3743131648,
3743133695,
'http://www.test.net/'))

[nikita_p]

Hi @spark2310,
One question i have..
Does ips such as 223.25.240.1 are present in your csv file? Because we will need one common field like this ip in both your logs and csv file.

[niketn]

@spark2310, please try the following run anywhere search which converts IP Address from Dot Decimal format to Integer IP format. (PS: You can remove first two pipes |makeresults and | eval ip_address... and replace with your current SPL with timechart to convert ip_address from your raw data to ip_address_integer which can be passed to lookup file.)

| makeresults
| eval ip_address = "223.25.240.0"
| eval ip_dot_decimal_split=split(ip_address,".")
| eval first=mvindex(ip_dot_decimal_split,0),second=mvindex(ip_dot_decimal_split,1),third=mvindex(ip_dot_decimal_split,2),fourth=mvindex(ip_dot_decimal_split,3)
| fields - ip_dot_decimal_split
| eval first=first*pow(256,3),second=second*pow(256,2),third=third*256
| eval ip_address_integer=first+second+third+fourth
| fields - first,second,third,fourth

PS: Also once you have tested and compare ip_address to corresponding ip_address_integer, towards the end of the search ip_address_integer can be actually called as ip_address to avoid creating of an additional field. Afterwards, you can consider saving the conversion command as a Macro so that it is persisted as a knowledge object for easier maintenance and re-usability.

[niketn]

@spark2310, were you able to try out the example? Is your issue resolved?