Ladies and Gentlemen,
I am have been trying for the better part of a week to get my lookup tables with CIDR and wildcards to work but I am having zero success.
My PROPS.CONF for both search is:
LOOKUP_needip = CIDR neededip AS IP
LOOKUP-wildcardip = MassIP wildcardip OUTPUT wildcard_site
filename = CIDR.csv
match_type = CIDR(neededip)
filename = wildcardIP.csv
DELIMS = " "
match_type = WILDCARD(wildcardip)
I am using a simple lookup at the beginning of the search ie:
sourcetype=foo host=bar [| inputlookup wildcard_IP.csv]
Are my props and transforms correct? I am at a loss.
Thanks for any help,
Check out this search result for troubleshooting:
sourcetype=foo host=bar | top wildcard_site
If that populates with sites from your lookup then your lookup works. If it does, replace your original search with this:
sourcetype=foo host=bar wildcard_site=*
The subsearch-based one you had would return a list of CIDR IPs and sites to filter for, without honouring the CIDR matching and without only looking for IPs and returning sites.
That suggests your automatic lookup is broken. Do post some sample events along with some sample lines from your lookup file.
What is the
DELIMS setting for your lookup file supposed to do?
the lookup table is set up like this:
123...*,"Department of Fashion"
So I am using the DELIMS for the wildcard_site side
I removed the DELIM, shortened the wildcard values for each IP and changed the PROPS.CONF to
LOOKUPwildcardip = wildcardIP wildcardip as dst OUTPUT wildcard_site
And I am getting results now.
Thanks for the help