Splunk Search

CIDR raw search?

the_wolverine
Champion

I'm using a CIDR lookup table against raw data (find a match in the entire event, any field.) It won't work, understandably with CIDR notation as my lookup.

Is there a command that can be used to expand the CIDR notation into all possible IP combinations?

0 Karma

Runals
Motivator

Just to be sure - have you gone under the covers to the transforms and added the CIDR match_type? Unfortunately unless something has changed in like 6.2+ you can't do this via the GUI. As an example I have a lookup named network-allocations and want to do CIDR lookups against the field network

[network-allocations]
filename = network-allocations.csv
match_type = CIDR(network)
max_matches = 1
min_matches = 1
0 Karma

the_wolverine
Champion

Yes, I've done this. Unfortunately, the configuration can only be applied a single field, not the entire event.

The method I'm using is to apply the match to "search":

[| inputlookup network-allocations | rename network as search | format ]

0 Karma

Runals
Motivator

First thing is remove | format. That command can be used to show you what the output of a search would be if it were a subsearch but you don't want to bake it into an actual subsearch.

It sounds as though if you had 10.10.10.0/24 in your lookup you are wanting to search across all of your data for each of the 256 addresses - correct? I don't think there is a command that will allow you to do that. I suppose you could come up with a case statement that translates 10.10.10.0/24 into 10.10.10.* and then maybe use a regex command after the initial results to make sure your data matches an IPv4 address (ie \d{1,3}.\d{1,3}.\d{1,3}.\d{1,3} ) but that seems like it would be high overhead and becomes a pain if you aren't using A, B, or C blocks . The most ideal scenario is if address fields have been defined in your data and search on explicit fields. The state of the data might not support that currently though.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...