Splunk Search

Using CIDRMatch with a lookup of range IP

aymane96
Engager

Hello community,

I have a query returning result with an IP address value (src_ip).

I used to add a line to match some Range IP : 

| where cidrmatch("Range IP", src_ip)

 

Now I have many other range IP to add. Instead of adding many lines, I created a CSV lookup with all these ranges.

range_ip    |  comment 
-----------------------
10.0.0.0/8 | range1
11.0.0.0/8 | range2
12.0.0.0/8 | range3

 

Do you have any idea how can I filter my result using CIDRMATCH function and based on range_ip column of my lookup CSV. 

 

Something like :

| where cidrmatch( range_ip IN lookup.csv, src_ip)

 

 

Thanks 

Labels (1)
Tags (3)
0 Karma
1 Solution

starcher
Influencer

You cannot use the CIDRMATCH feature of lookups without properly defining the lookup. Doing it as a CSV will not work. You need to setup the transforms name and associated feature like CIDR match type. Then use the lookup AS a lookup not a list.

https://docs.splunk.com/Documentation/Splunk/9.0.1/Knowledge/Addfieldmatchingrulestoyourlookupconfig...

View solution in original post

0 Karma

starcher
Influencer

You cannot use the CIDRMATCH feature of lookups without properly defining the lookup. Doing it as a CSV will not work. You need to setup the transforms name and associated feature like CIDR match type. Then use the lookup AS a lookup not a list.

https://docs.splunk.com/Documentation/Splunk/9.0.1/Knowledge/Addfieldmatchingrulestoyourlookupconfig...

0 Karma

aymane96
Engager

Hello @starcher 

Thank you so much, it works like a charm.

I used the lookup definition based on my CSV and specified the matchtype as CIDR.

 

Many thanks

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...