How to create a field based on cidrmatch in Splunk 6.2?

[lbogle]

Hello,

I am using Splunk 6.2 and I am trying to use |eval cidrmatch in a search to identify a series of subnets by a common name. I am using the following:

some search highlighting individual IP's by field clientIP | eval voipnet=cidrmatch("111.111.0.0/16",clientIP) | eval tecnet=cidrmatch("222.222.0.0/16",clientIP) | eval secnet=cidrmatch("333.333.0.0/16",clientIP) | table clientIP,clientSplunkName,clientNetworkName,voipnet,tecnet,secnet | dedup clientIP

But I keep getting the error:

Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr])

Based on the reference documentation, it looks like my search *may have worked in v.5. Any recommendations on how to do this in version 6.2?

[lloydd518 · Accepted solution]

Hi there...

As per http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonEvalFunctions

Cidrmatch returns true or false and works well nested in an "if" statement

So in order to add knowledge to your data.. You could try

some search highlighting individual IP's by field clientIP | eval voipnet=if(cidrmatch("111.111.0.0/16",clientIP),client ip,"") | eval tecnet=if(cidrmatch("222.222.0.0/16",clientIP),client ip,"") | eval secnet=if(cidrmatch("333.333.0.0/16",clientIP),clientIP,"") | table clientIP,clientSplunkName,clientNetworkName,voipnet,tecnet,secnet | dedup clientIP

Each eval works if cidrmatch matches the clientIP again the iprange. It passes true to the if statement.
The if statement then makes sure that voipnet = clientIP because the result true was returned. If the cidrmatch returns false... Then voipnet is still created but is empty... You can still search voipnet= "". Your table should pull all results together. It's probably not the prettiest way to do this, there may even be a more efficient way. Hope this helps...

[lloydd518]

A quick and dirty method would be to insert a filter before or after we table the results...

some search highlighting individual IP's by field clientIP | eval voipnet=if(cidrmatch("111.111.0.0/16",clientIP),client ip,"") | eval tecnet=if(cidrmatch("222.222.0.0/16",clientIP),client ip,"") | eval secnet=if(cidrmatch("333.333.0.0/16",clientIP),clientIP,"") | search voipnet!="" OR tecnet!="" OR secnet!="" | table clientIP,clientSplunkName,clientNetworkName,voipnet,tecnet,secnet | dedup clientIP

The filter ensures that results where all 3 fields are empty, are excluded from the final results.. Hopefully! 🙂

[lbogle]

That seems to work! Great job!
Question though, the search returns results that are not categorized by either of the three eval functions. How do I get it to only show the items marked in the voipnet, secnet and tecnets?
Thanks!