I have a lookup table which consists of src_ip. This source Ip has mix of Ips in the format:
I need to match this lookup table to my search which consists of the field src_ip in my data. But how do i do that since it is a mix of cidr and normal ips? My actual data for src_ip doesnt consits of cidr ips. Can someone let me know ?
You have a lookup file, says ips.csv and then you create a lookup definition (which is an abstraction layer on top of the lookup file). Connect it to the actual file itself and then set the Src_ip field to be a CIDR type field like this
then just use the lookup definition in the lookup command, not the file itself, so
| lookup ips Src_ip as src_ip output Src_ip as ipFound
so this assumes your event field is src_ip and the CSV file has a column called Src_ip. After this executes, you will have a new field ipFound if the IP exists in the CIDR range of one of the ranges, or null if not.