I'm trying to create a dashboard that lets a user input an IP address and then search through the IP address database to search for the subnet and location.
e.g. if someone enters 10.10.10.123, it would basically do a search through a csv of "10.10.10."
So I've tried this for example (among a 1000 other things)
| inputlookup IPAM-Allnetworks.csv
| search address=10.10.10.123 (This would obviously be the $address$ from the form)
| rex field=address "(?\d+.\d+.\d+.)\d+"
| where address = src_subnet
| table address cidr location VLAN (i.e. interesting fields from CSV)
Yes, this will only work for /24 subnets, but will cover most use cases.
The problem I see is that I need to extract the fields before actually searching. I can see why my search doesn't work but not sure how to fix it.
You need to do something like this
|makeresults
| eval ip = 10.10.10.123 (This would obviously be the $address$ from the form)
| rex field=ip "(?<address>\d+.\d+.\d+.)\d+"
| lookup IPAM-Allnetworks.csv address OUTPUT
| table address cidr location VLAN (i.e. interesting fields from CSV)
This code assumes that your CSV has a column called "address" in it
The lines of the lookup table look something like this:
network,10.10.10.0,255.255.255.0,10.10.10.0/255.255.255.0,,,,,,Core/Server Room,,,,,FALSE,,,,,,,,,FALSE,FALSE,,,,,,,FALSE,LAN Addressing,,,,95,85,0,10,,,,,,,,,,,,,Site ABC,,OVERRIDE,432,,Voice Vlan222,*,OVERRIDE
I'm searching on field 2 (which is the "address" field).
I sort of got it working by adding a "0" to the extracted field, e.g.
|makeresults
| eval ip = "10.10.10.123"
| rex field=ip "(?\d+.\d+.\d+.)\d+"
| eval address=address1."0"
| lookup IPAM-Allnetworks address OUTPUT
| table
but is there a way to do a wildcard search instead? (i.e. 10.10.10.*)
Thx
PS: Not sure what happened to the previous comments.
Thanks. I tried something similar, but the eval command gives me:
Error in 'eval' command: The number 10.10.10.123 is invalid.
Quotes around it worked. I just need to work out how to add a "*" wildcard to the end of the search so that it searches:
address=10.10.10.*
You need to show a couple of sample rows from your lookup so we can help you better. I assumed the lookup had an "address" column with just the first three octets in the column
Sorry. The lines look something like this:
network,10.10.10.0,255.255.255.0,10.10.10.0/255.255.255.0,,,,,,Core/Server Room,,,,,FALSE,,,,,,,,,FALSE,FALSE,,,,,,,FALSE,LAN Addressing,,,,95,85,0,10,,,,,,,,,,,,,Site ABC,,OVERRIDE,432,,Voice Vlan222,*,OVERRIDE
I'm searching on field 2 (address).
Thx