cidr match is not properly working

[syazwani]

Hi,

Why my CIDR matching in not following the lookup content?

Query i used is as below:

| makeresults
| eval ip="10.10.10.10"
| lookup testip ip OUTPUTNEW description

Result should look like this:

ip	Description
10.10.10.10	New

But the real output look like this:

ip	Description
10.10.10.10	New In Progress Closed

I have check my lookup and its clearly state the Description for IP Range 10.10.10.10/27 is "New".

Please help and thanks!

[yuanliu]

1. Is your lookup's ip field using CIDR notation?
2. Did you set up CIDR(ip) in lookup definition?
3. Is there any overlapping CIDR's (ip) that 10.10.10.10 can match in your lookup?

About 3, for example, if your lookup is like this:

ip	Description
10.10.10.10/27	New
10.10.10.0/24	In Progress
10.10.8.0/16	Closed

10.10.10.10 will match all three.

[jotne]

Post the output of:

| inputlookup testip

If its to long post part with IP 10.10.10.x