Splunk Search

Multi Subnets in a Macro

albyva
Communicator

How would you structure a macro to list dozens of IP Subnets?

For example: If you want a macro to list the following, what is the correct macro syntax?

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

0 Karma

lguinn2
Legend

I am not sure why you want to use a macro. It would help if we had more context.

However, if I were going to run a search that needed to determine which events had IPs that matched a list of subnets, I would use a lookup.

I would create a file subnet.csv that contained

ip,subnetName
10.0.0.0/8,internal group 1
172.16.0.0/12,internal group 2
192.168.0.0/16,internal group 3

etc., and upload it to splunk as a lookup table.

props.conf

[yoursourcetypehere]
LOOKUP-lsubnet = subnet_lookup ip OUTPUT subnetName

transforms.conf

[subnet_lookup]
filename = subnet.csv
match_type = CIDR
min_matches = 1
max_matches = 1
default_match = unmatched

Then you could use this search to identify events from one of the subnets:

yoursearchhere | where subnetName != "unmatched"

Or this might be interesting

yoursearchhere | stats count by subnetName

Here is the Splunk Lookups Tutorial, if you need more info. One of the nice things about this solution is that you can edit and reload the csv file with new subnets as needed, and all of the searches that use the lookup will automatically use the latest list.

0 Karma

lguinn2
Legend

When you are logged into Splunk, go to the app and then to Manager > Lookups

Under Actions for Lookup table files, click Add New.

This will upload the file to $SPLUNK_HOME/etc/apps/appname/lookups or you can move the file there directly via the OS.

0 Karma

albyva
Communicator

lguinn: You are right, I want to run a search and determine which events had IPs that matched a list of subnets. Where am I uploading this file? Thanks,

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...