Splunk lookup (not inputlookup) and cidr matching

[cybersecnutant]

Hello,

I have a search that's coming back with 'src' which is the source IP of a client, and I have a lookup file  called "networks.csv" that has a column with a header 'ip' which is a list of CIDR networks. I have gone into the lookup definitions and set under the advanced options "CIDR(ip)" for that lookup file. I can see the headers being automatically being extracted in that UI. However, when I run the search and try to pull the category for the 'src' respective network, it does not work. 

basesearch
| lookup networks.csv ip as src_ip OUTPUT category


I have validated that it's a CIDR issue by doing a "...| rex mode=sed field=src_ip " and placing a literal CIDR entry in there and having the category come out.

Thank you for your help!

[dtburrows3 · Accepted solution]

Do you have the same issue when referencing the lookup definition itself instead of the CSV file?
Example:

<base_search>
    | lookup <lookup definition pointing to networks.csv> ip as src_ip OUTPUT category

I think that the advanced settings may only be applied when referencing the definition.

[cybersecnutant]

Thank you! That was it.