I have a field in Splunk that contains IPs such as 223.xx.xxx.1
query: index=traffic_logs ip_address=*|timechart span=1h count by ip_address
I want to write a query to timechart ips traffic that match in one of the ranges in the csv file below (it had ip ranges in decimal format), so the ip above should return http://thegigabit.com since it exists in the range.
(( 3743019008, -----> this is actually 184.108.40.206 if converted to IP format
3743020031, -----> range end 220.127.116.11
@spark2310, please try the following run anywhere search which converts IP Address from
Dot Decimal format to
Integer IP format. (PS: You can remove first two pipes
| eval ip_address... and replace with your current SPL with timechart to convert ip_address from your raw data to ip_address_integer which can be passed to lookup file.)
| makeresults | eval ip_address = "18.104.22.168" | eval ip_dot_decimal_split=split(ip_address,".") | eval first=mvindex(ip_dot_decimal_split,0),second=mvindex(ip_dot_decimal_split,1),third=mvindex(ip_dot_decimal_split,2),fourth=mvindex(ip_dot_decimal_split,3) | fields - ip_dot_decimal_split | eval first=first*pow(256,3),second=second*pow(256,2),third=third*256 | eval ip_address_integer=first+second+third+fourth | fields - first,second,third,fourth
PS: Also once you have tested and compare ip_address to corresponding ip_address_integer, towards the end of the search
ip_address_integer can be actually called as
ip_address to avoid creating of an additional field. Afterwards, you can consider saving the conversion command as a
Macro so that it is persisted as a knowledge object for easier maintenance and re-usability.