Splunk Search

ipmask (dys-)function: Why the SPL parser does not handle this fairly common case?

jpvlsmv
Path Finder

The documentation (9.0.2 Search Reference)  describes a function ipmask(<mask>,<ip>) that is supposed to apply the given netmask to the given IP.  Seems pretty simple, and the examples are mostly straightforward... unless you consider what a netmask of 0.255.0.244 would actually mean on the network.

The more interesting problem is what you're allowed to pass to this function.  From what I can tell, the first parameter MUST be a quoted string of digits, and particularly NOT the name of a field in your data:

 

 

|makeresults 1 | eval ip = "1.2.3.4", mask = "255.255.255.0"

 

 

 

With these values defined,

| eval k = ipmask("255.255.255.0", "5.6.7.8") works fine, k=5.6.7.0

| eval k = ipmask("255.255.255.0", ip) works fine, k=1.2.3.0

| eval k = ipmask("255.255.255.0", mask) works fine, k=255.255.255.0 (but isn't a meaningful calculation).

| eval k = ipmask(mask, "5.6.7.8") does not work: Error in 'EvalCommand': The arguments to the 'ipmask' function are invalid.

| eval k = ipmask(mask, ip) does not work: Error in 'EvalCommand': The arguments to the 'ipmask' function are invalid.

I'm sure there's some highly technical reason why the SPL parser does not handle this fairly common case, and if there's anyone who can share that reason, I'd love to hear it.

--Joe

Labels (1)
Tags (4)

tfujita_splunk
Splunk Employee
Splunk Employee

Hi,

The inability to pass a field name as the first argument of ipmask prevents this function from calculating the network address when the netmask is variable.
Also, with IPv6 addresses, it cannot be used as a method of calculating network addresses.
This seems to limit the use of the ipmask function very much.

I added the following external command lookup to the App below as an alternative method of ipmask.

Usage:

| makeresults
| eval ip="192.0.2.17/255.255.255.240"
| lookup local=t ipcalclookup Address as ip OUTPUT Network Netmask Prefix Broadcast
| table ip Network Netmask Prefix Broadcast

ipcalclookup.png

Input Address can also be in the following format.

* ip/netmask: e.g. 192.0.2.17/255.255.255.240

* ip/prefix: e.g. 192.0.2.17/28

* ipv6/prefix: e.g. 2001:db8:1234::1/64

 

Numeral system macros for Splunk 

https://splunkbase.splunk.com/app/6595

 

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Time to hit Ideas🤣

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...