Splunk Search

cidrmatch function not working

Ronvgraham
Engager

I have imported two Cisco firewall configurations and I am trying to extract IP addresses for our local machines. Therefore I only want to match on subnets that are within our control. I have put together the following command to match on one of our private ip ranges but it appears to always be defaulting to other:

index=fw 
| rex max_match=5 "(?P<IP_add>\s\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" 
| eval network=if(cidrmatch("10.0.0.0/8", IP_add), "Network", "other")
| stats count by IP_add,network

I have also tried to use the | where NOT cidrmatch("10.0.0.0/8",IP_add) notation but that does not seem to select the proper subnets either. Can someone help me understand why the cidrmatch function does not appear to be working for my searches.

Do I have to set up the transforms file to use the cidrmatch function and if so can someone help me with the proper code to get this done based on the above?

0 Karma

Ronvgraham
Engager

To add some more information. With my regex there may be more than one IP address on a line so it may add more than one IP address to the IP_add field. This may be related to the problem.

0 Karma

Ronvgraham
Engager

I tried your example and it works properly on my system as well. When I run my original example the regex matches "other" for all IP addresses even though some of them are in the 10.x.x.x subnet. The fields that were generated by my regex are alphanumeric.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi Ronvgraham,

this works perfectly:

| stats count | eval IP_add="11.10.10.10" 
| eval network=if(cidrmatch("10.0.0.0/8", IP_add), "Network", "other")
| stats count by IP_add,network

What does your regex match? Is the field value returned numeric or alphanumeric?

cheers, MuS

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...