Splunk Search

Lookup in range value

gavintofly
New Member

Can I use lookup in a range value situation ? For example, the IP address:
10.0.1.0/24 for A area
10.0.2.0/24 for B area
when I input a single ip 10.0.1.2 in search bar,the lookup command will return A area.
If this can be done,how to configure it in splunk?

Tags (2)
0 Karma

rtadams89
Contributor

You want to have a lookup table such as:

IPRange, Area
10.0.1.0/24, A
10.0.2.0/24, B

Then when an event has a field ip=10.0.1.2, add area=A onto the event. I can think of a few ways to do this, not sure which is best based on the specifics of yoru situation.

1) Change the lookup table to include every IP address and its Area. So instead of 10.0.1.0/24, include 10.0.1.1, 10.0.1.2, 10.0.1.3, .... in the table.

2) Break the IP address up into 4 sections, and then compare the third section with a lookup table to determine what area the IP is in. So "1"=A, "2"=B, ....

3) Use "cidrmatch" in your search string to classify IPs instead of usign a lookup table at all.

3) Use "cidrmatch" in your string to add an additional field to each event that has the range the IP is in as the value. So if the ip is 10.0.1.2, use cidrmatch to add a field/value pair cidr="10.0.1.0/24". Then do the lookup on the field cidr.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...