I have a field in Splunk that contains IPs such as 223.xx.xxx.1
query: index=traffic_logs ip_address=*|timechart span=1h count by ip_address
I want to write a query to timechart ips traffic that match in one of the ranges in the csv file below (it had ip ranges in decimal format), so the ip above should return http://thegigabit.com since it exists in the range.
@spark2310, please try the following run anywhere search which converts IP Address from Dot Decimal format to Integer IP format. (PS: You can remove first two pipes |makeresults and | eval ip_address... and replace with your current SPL with timechart to convert ip_address from your raw data to ip_address_integer which can be passed to lookup file.)
PS: Also once you have tested and compare ip_address to corresponding ip_address_integer, towards the end of the search ip_address_integer can be actually called as ip_address to avoid creating of an additional field. Afterwards, you can consider saving the conversion command as a Macro so that it is persisted as a knowledge object for easier maintenance and re-usability.