Splunk tstats search with IPV6 subnet - WHERE clause is not an exact query

[mfleitma]

Hello,

I want to run a datamodel tstats search, excluding some events with a lookup for src_ip's. In case I fill the lookup with a ipv6 subnet, the search breaks with Error in 'TsidxStats': WHERE clause is not an exact query.

My query in a simple way:

-------------------------
| tstats summariesonly=t allow_old_summaries=t values(sourcetype) as sourcetype count AS eventCount max(_time) as maxtime min(_time) as mintime from datamodel=Intrusion_Detection
where (nodename = IDS_Attacks)

NOT [ | inputlookup ip_test.csv | fields src ]

groupby IDS_Attacks.src, IDS_Attacks.dest, IDS_Attacks.signature, IDS_Attacks.action

------------------------

lookup ip_test.csv:

comment,src
ipv4 net,10.20.30.0/24
ipv4,10.20.30.43
ipv6,1a00:2a60:3000:1:1:43
ipv6 net,1a00:2a60:3000:1::/64

With deleting the "ipv6 net" entry the search is running.

[tscroggins]

Hi @mfleitma,

IPv6 CIDR matching with tstats _should_ work in Splunk Cloud 9.1.2312 and Splunk Enterprise 9.3 or later. Previous versions included this tstats limitation:

CIDR matching support for IPv4 and IPv6 addresses

The tstats command filters events with CIDR match on fields that contain IPv4 addresses, but not IPv6 addresses. Running tstats searches containing IPv6 addresses might result in the following error indicating that the addresses are treated as non-exact queries:

Error in 'TsidxStats': WHERE clause is not an exact query

Newer versions include this limitation:

Limitations of CIDR matching with tstats

As with the search command, you can use the tstats command to filter events with CIDR match on fields that contain IPv4 and IPv6 addresses. However, unlike the search command, the tstats command may not correctly filter strings containing non-numeric wildcard octets. As a result, your searches may return unpredictable results.

However, tstats still returns the "exact query" error in Splunk Enterprise 10.0.

If your environment is optimized, i.e., you're not using source type renaming or other features that defeat search optimization directives, you may be able to use the datamodel command and achieve performance similar to tstats:

| datamodel Intrusion_Detection IDS_Attacks flat summariesonly=true allow_old_summaries=true
| search NOT [ | inputlookup ip_test.csv | fields src ]
| stats values(sourcetype) as sourcetype count as eventcount max(_time) as maxtime min(_time) as mintime

[richgalloway]

It sounds like some of the data in the lookup file is confusing the SPL parser.  When you run the subsearch by itself with format, does the output look like valid SPL?

| inputlookup ip_test.csv | fields src | format