Dear Team,
What i am trying to achieve is like this:
I have a lookup table with many subnets. I am trying to match the destination host IP with the suitable subnet from the table.
| index dhcp
| lookup IPtable ip as dest_host OUTPUT ip as dest_match
The problem is the IP column in IPtable contains IP subnet only. How do I solve it?
Any help would be much appreciated!
Hi phudinhha,
you're lookup for the match_type = CIDR()
http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Addfieldmatchingrulestoyourlookupconfigu... in transforms.conf
. See this example https://answers.splunk.com/answers/305211/how-to-match-an-ip-address-from-a-lookup-table-of.html
Hope this helps ...
cheers, MuS
Hi Mus and sundareshr
The problem is i don't have access to transforms.conf file, and i would like to compare the dest_host field with the IP column which contains subnet from the lookup table.
This will be tricky since you need at add some eval
and use searchmatch
to compare it ..... let me think about it
Much easier option, get someone with access to transforms.conf
make the change and everyone can benefit from it!