Splunk Search

subnet information

nishit_92
Explorer

I have subnet lookup in cidr notation. so i am trying to print subnet detail with dest ip but not getting result.

query:-
index=xyz | stats count by dest | lookup subnet.csv subnet as dest output subnet as subnets

I have no any transformation stanza right now so let me know if any other staza require to compute this or any other way.

0 Karma
1 Solution

maciep
Champion

Yes, either in the web gui or in transforms.conf (which is where the web will write it), you need to specify the match type for that field.

https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Transformsconf#Lookup_tables

match_type = <string>
* A comma and space-delimited list of <match_type>(<field_name>)
  specification to allow for non-exact matching
* The available match_type values are WILDCARD, CIDR, and EXACT. Only fields 
  that should use WILDCARD or CIDR matching should be specified in this list.
* Default: EXACT 

So probably something like this in transforms:

[subnet]
filename = subnet.csv
match_type = CIDR(subnet)

And if you want the lookup to happen automatically, that would be in props.conf (but also in the web).

So the simple lookup is in the lookups directory. The table definition (case sensitivity, wildcards, max matches, etc) is defined in transforms. And automatically running the lookup command for host/source/sourcetype is done in props.

View solution in original post

maciep
Champion

Yes, either in the web gui or in transforms.conf (which is where the web will write it), you need to specify the match type for that field.

https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Transformsconf#Lookup_tables

match_type = <string>
* A comma and space-delimited list of <match_type>(<field_name>)
  specification to allow for non-exact matching
* The available match_type values are WILDCARD, CIDR, and EXACT. Only fields 
  that should use WILDCARD or CIDR matching should be specified in this list.
* Default: EXACT 

So probably something like this in transforms:

[subnet]
filename = subnet.csv
match_type = CIDR(subnet)

And if you want the lookup to happen automatically, that would be in props.conf (but also in the web).

So the simple lookup is in the lookups directory. The table definition (case sensitivity, wildcards, max matches, etc) is defined in transforms. And automatically running the lookup command for host/source/sourcetype is done in props.

nishit_92
Explorer

Thanks @maciep
Also, I am not aware about connectivity between props.conf and automatic lookup. Thanks for sharing.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...