Splunk Search

cidrmatch function not working

Ronvgraham
Engager

I have imported two Cisco firewall configurations and I am trying to extract IP addresses for our local machines. Therefore I only want to match on subnets that are within our control. I have put together the following command to match on one of our private ip ranges but it appears to always be defaulting to other:

index=fw 
| rex max_match=5 "(?P<IP_add>\s\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" 
| eval network=if(cidrmatch("10.0.0.0/8", IP_add), "Network", "other")
| stats count by IP_add,network

I have also tried to use the | where NOT cidrmatch("10.0.0.0/8",IP_add) notation but that does not seem to select the proper subnets either. Can someone help me understand why the cidrmatch function does not appear to be working for my searches.

Do I have to set up the transforms file to use the cidrmatch function and if so can someone help me with the proper code to get this done based on the above?

0 Karma

Ronvgraham
Engager

To add some more information. With my regex there may be more than one IP address on a line so it may add more than one IP address to the IP_add field. This may be related to the problem.

0 Karma

Ronvgraham
Engager

I tried your example and it works properly on my system as well. When I run my original example the regex matches "other" for all IP addresses even though some of them are in the 10.x.x.x subnet. The fields that were generated by my regex are alphanumeric.

0 Karma

MuS
Legend

Hi Ronvgraham,

this works perfectly:

| stats count | eval IP_add="11.10.10.10" 
| eval network=if(cidrmatch("10.0.0.0/8", IP_add), "Network", "other")
| stats count by IP_add,network

What does your regex match? Is the field value returned numeric or alphanumeric?

cheers, MuS

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...