Splunk Search

cidrmatch() returning no matches

splunknewby
Path Finder

I'm using cidrmatch() to determine whether a particular IP is on a local network, but when I query Splunk it returns nothing even though there are local IP addresses in the ingested data.

I'm running the following query:
index=main | stats count | eval ip=src_addr | eval network=if(cidrmatch("192.168.0.0/16",ip),"Local","Other") | stats count by ip, network

which returns no results, even though there are IP addresses in the 192.168.0.0/16 domain.

What could be the issue?

Could it be that the src_add field is saved a string. Is there a way for Splunk to save that as an IP address field?

0 Karma
1 Solution

HiroshiSatoh
Champion

index=main | stats count |・・・・
->Field is only to count.

View solution in original post

HiroshiSatoh
Champion

index=main | stats count |・・・・
->Field is only to count.

MuS
SplunkTrust
SplunkTrust

Or maybe a bit more detailed: What @HiroshiSatoh means is, you will loose any fields after the stats count if you don't define them along side of the stats. So you will only have a field called count after the stats count remove it form your search and it should return results as long you have a field called src_addr 😉

splunknewby
Path Finder

Hey MuS, I tried that and got a few hits. Only I now see a few 192.168.x.x addresses being classified as "Other"?

0 Karma

MuS
SplunkTrust
SplunkTrust

could it be that you have some multivalue fields or the src_ip field is not always nummeric?

splunknewby
Path Finder

Ah! cheers, my address ingestion is doubling up for some reason. I used mvindexto grab the first entry and ran cidrmatch() with success.

0 Karma

MuS
SplunkTrust
SplunkTrust

You're welcome, feel free to upvote any useful answers 😉

splunknewby
Path Finder

Quick question, is there a away to filter for ipv6 addresses?

0 Karma

MuS
SplunkTrust
SplunkTrust

Sure, for example to use the cidrmatch() for 2001:0000:1234:1234:1234:1fff:2eee:3ddd address, you can just do something like this:

........... | eval network=if(cidrmatch("2001:0000::/32",clientip), "local", "other")

splunknewby
Path Finder

Hey Mus, is there a way to capture all private ipv6 addresses?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...