Is it possible to get a count of IPs from one lookup table that match each subnet in CIDR format in another lookup?

[jizzmaster]

I want to perform a CIDR match on a list of IPs and a list of subnets.

In a lookup table I have a list of subnets in CIDR format. In another list I have a few hundred IPs. My goal is to get a count of IPs from the IP list that match each subnet from the subnet list. Is this possible?

I've found the cidrmatch function in the eval and where commands, but I have not been able to take the subnet variable in cidrmatch and make it look at a lookup table to match. Maybe I'm going about this the wrong way though. Any assistance is appreciated.

Example Lookup Table

Subnet
10.20.0.0/16
10.21.0.0/16

Example Lookup Table

IP
10.20.5.3
10.20.3.4
10.21.75.1
10.21.34.5
10.21.122.11

Desired Output

Subnet               Count
10.20.0.0/16          2
10.21.0.0/16          3

[sideview · Accepted solution]

you want to use inputlookup command to get the first lookup as the search result rows, and then pipe that to a lookup command to do a cidr match based on the second lookup's rows.

I don't think there's a way to do a CIDR match lookup completely inline, ie with just a standard file-based lookup and with the search language.

But if you put this in local/transforms.conf

[firstLookupName]
filename = yourFileNameHere.csv
match_type = CIDR(Subnet)

[secondLookupName]
filename = yourOtherFileNameHere.csv

And if you tack on some other field in the first lookup (single field lookups may be existentially uncomfortable, ie splunk may fail to load them if they only have one field). Let's say that field is "is_sketchy" and the values are all "1".

Then you should be able to do:

| inputlookup secondLookupName | lookup firstLookupName Subnet as IP OUTPUT Subnet | stats count by Subnet

[sideview]

Sorry I had to update the answer about 10 minutes after I posted it, cause of a couple mistakes I found later.

[jizzmaster]

Yea, in a way I was hoping for an inline CIDR match. But the regular lookup works once I put a stanza in the transforms.conf. 'Tis a shame that the inline ability is seemingly not possible.