Splunk Search

eval case/cidrmatch using two fields as a condition

whitefang1726
Path Finder

How can I use cidrmatch or case using 2 conditions?

Example: I only want to get list of IPs where row_A is 11.0.0.0/24 and row_B is 8.8.8.0/24

Current Table:
row_A row_B
10.0.0.1 11.0.0.1
10.0.0.2 12.0.0.1
11.0.0.1 8.8.8.8
11.0.0.2 8.8.8.9
12.0.0.1 8.8.8.8
12.0.0.2 8.8.8.9

Target Result:
row_A row_B
11.0.0.1 8.8.8.8
11.0.0.2 8.8.8.9

Thanks!

Tags (2)
0 Karma

manjunathmeti
Champion

hi @whitefang1726,

Use where command like this:

| where cidrmatch("11.0.0.0/24", row_A) and cidrmatch("8.8.8.0/24", row_B)

Smaple query:

| makeresults 
| eval _raw=" row_A row_B
10.0.0.1 11.0.0.1
10.0.0.2 12.0.0.1
11.0.0.1 8.8.8.8
11.0.0.2 8.8.8.9
12.0.0.1 8.8.8.8
12.0.0.2 8.8.8.9" 
| multikv forceheader=1 
| where cidrmatch("11.0.0.0/24", row_A) and cidrmatch("8.8.8.0/24", row_B)
| fields - _raw, _time, linecount
0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more!  Faster Time to Value Managing and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...