Splunk Search

lookup file with a mix of ranges of IP and unique IP

faribole
Path Finder

Hi all

I use a lookup file with a mix of ranges of IP and unique IP to count events of login

My file is like this

ip,entity
10.0.1.0/24, A
10.0.2.0/24, B
12.0.0.4,C
12.0.0.8,C

I configure my lookup file with CIDR option but the result of search only extract the
events of ip integrated in ranges of ip.

I woulld like to extract all the results

how can I solved this with only one lookup file ?

0 Karma

nickhills
Ultra Champion

You need all addresses in your lookup to be in CIDR notation, that means your lookup should look like this.

ip,entity
10.0.1.0/24,A
10.0.2.0/24,B
12.0.0.4/32,C
12.0.0.8/32,C
If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...