Splunk Search

Search against lookup table with both CIDR and regular addresses

Path Finder

I have a lookup table consisting of both CIDR addresses and regular x.x.x.x addresses under the field named "IP_Address". The lookup definition has  Match type:  <CIDR>(<IP_Address>)

I need to create a search against data model that only shows events where the src in the events matches the IP_Address field in the lookup table.   I will also add additional fields from the events to the search results: _time, action, IP_Address/src, dest, dest_port.  I would also like to add an additional field from the lookup table called "Date Blocked".

I have this so far for the first part, but it is not returning any results. Any suggestions? Thank you in advance 🙂



from datamodel:"Network" |where [inputlookup Blocked_IPs | rename src as IP_Address | fields IP_Address ]| table _time, action, IP_Address, dest, dest_port



Labels (1)
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...