Splunk Search

lookup file with a mix of ranges of IP and unique IP

faribole
Path Finder

Hi all

I use a lookup file with a mix of ranges of IP and unique IP to count events of login

My file is like this

ip,entity
10.0.1.0/24, A
10.0.2.0/24, B
12.0.0.4,C
12.0.0.8,C

I configure my lookup file with CIDR option but the result of search only extract the
events of ip integrated in ranges of ip.

I woulld like to extract all the results

how can I solved this with only one lookup file ?

0 Karma

nickhills
Ultra Champion

You need all addresses in your lookup to be in CIDR notation, that means your lookup should look like this.

ip,entity
10.0.1.0/24,A
10.0.2.0/24,B
12.0.0.4/32,C
12.0.0.8/32,C
If my comment helps, please give it a thumbs up!
0 Karma