Trying to map IP address from lookup table in search

[wailoont]

Hi,

I am trying to map the ip address in my search to my lookup table, and it should return me the countries of the IP address.

Sample lookup table

country ip_address
Italy 2.123.123.9/24, 2.124.124.9/11

Problem is, in my events, my IP address is 2.123.123.1.

I want to search the ip_address in the lookup table perhaps for 2.123.123 and return me Italy ?

This is my search query

index=ip_address "status=200" ip_address
| lookup ip_mapping.csv ip_address outputnew u_country as country

The search executed successfully, but there is no country being returned. What am i missing ?

[starcher]

You need to do several things.
1. configure a lookup definition which cidrmatching
2. reference the lookup definition name in the lookup command NOT the filename.csv. When you reference the file directly you bypass the lookup definition features and break your cidrmatching

Optional
1. Why are you using a custom table instead of updating the geolocation database and using the iplocation command?

• https://github.com/georgestarcher/TA-geoip
• https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Iplocation

https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Iplocation

[to4kawa]

splunk-lookups-with-cidr-matching

Is the setting OK?

[493669]

assuming your lookup has field name as country and ip_addressthen try below search-

 index=ip_address "status=200" ip_address
 | lookup ip_mapping.csv ip_address OUTPUT  country as Country

After OUTPUT you need to specify lookup fieldname