Splunk Search

How to use the cidrmatch function in a search to get the ISP for an IP address using a lookup with cidr ip blocks?

cdo_splunk
Splunk Employee
Splunk Employee

I am trying to get the ISP for an IP address using a database with cidr ip blocks

The lookup file is "GeoIPISP.csv" with these columns
start_ip,end_ip,isp,cidr

The main search is something like
index="nginx" | top ip

I am trying to use cidrmatch, but it requires to cidr block as the first parameter.
How do I join them together to show the ISP?

Tags (3)

rsennett_splunk
Splunk Employee
Splunk Employee

cidrmatch is a function for eval or where. You're not showing how you'd use it, but I think you might be misinterpreting the instructions.
the syntax is:
cidrmatch("X",Y)

the first parameter, X is the CIDR but the order of parameters has nothing to do with...anything else.

|eval mymatch=cidrmatch(cidr,ip)

So you would look em up, and then do the eval and whatever else you want.

But that's not what it seems you're looking for.
The definition in transforms.conf for the lookup needs:
match_type=CIDR

transforms.conf
[geoIPISP]
filename=GeoIPISP.csv
match_type=CIDR(isp)

index=nginx|[inputlookup geoIPISP |fields isp |rename isp AS ip]|top ip limit=1

The search example you have isn't looking at the lookup table.
So you use a sub search to grab the value and that's passed to the outer search. (and the rename normalizes the filenames)

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

cdo_splunk
Splunk Employee
Splunk Employee

I want to match an IP in the log file to an ISP defined in the GeoIPISP lookup.

so, assume If I run this search:
index="nginx" | top limit=1

it returns:
1.0.0.1
Also assume, GeoIPISP.csv has two lines:
start_ip,end_ip,isp,cidr
16777216,16777471,Google,1.0.0.0/24<http://1.0.0.0/24>

I want to look up that IP 1.0.0.1 is in the cidr block of 1.0.0.0/24<http://1.0.0.0/24>, which then returns the ISP Google.

From the info above, I think this will work

in transforms.conf:
[geoip_isp]
filename = GeoIPISP_cidr.csv
max_matches = 1
min_matches = 1
default_match = OK
match_type = CIDR(ip)

in props.conf
[nginx]
LOOKUP-geoip = geoip_isp ip OUTPUT start_ip end_ip isp

Then this search
index="nginx" | top isp limit=1

will return:
Google

is that right, or am I missing something?

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

I've edited my answer now that the question is more clear.
Your example doesn't actually touch the lookup table at all... so I wasn't sure where you were going.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...