How to create a new internal IP field, at search time, from src and dest IP fields?

[JSkier]

I'd like to create a field at search time, we'll call it internal_ip. I can already filter by CIDR block and get the results I want, but I need more depth than that for a lookup I'd like to do. The problem is with my IDS logs, depending on the directional flow, the internal IP can be either src_ip or dest_ip (this particular search will never return both internal IP addresses). I'd like a query to search both src_ip and dest_ip fields for a specific private network IP block, and assign that value to my new field. How do I accomplish this?

[somesoni2 · Accepted solution]

What you need is a calculated field which will take the first non-null value from src_ip and dest_ip field and assign to internal_ip field. More info here. http://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/definecalcfields

props.conf

[yoursourcetype]
EVAL-internal_ip = coalesce(src_ip,dest_ip)

[JSkier]

Thanks for the quick response, but coalesce takes the first non-null value, which means data will be missing. I imagine it will be a more complicated query.

[somesoni2]

In an event, you'll have either src_ip OR dest_ip right? So it'll take whatever is available. Easiest option is the run following query and check.

your base search for yoursourcetype | table src_ip dest_ip | eval internal_ip = coalesce(src_ip,dest_ip)

[JSkier]

I need to clarify, there will always be one src and one dest IP. What I meant to say is, there will never be an internal IP for BOTH src and dest IPs. Basically one IP will always be internal, and the other will always be external. Sorry for the confusion.

[somesoni2]

So if you've a way to identify the internal ip, may using the subnet, then you can use a cidrmatch("X",Y) function in eval to check which one is the internal ip and use that. Like this (using sample ip subnet)

props.conf

[yoursourcetype]
EVAL-internal_ip= if(cidrmatch("123.132.32.0/25",src_ip),src_ip,dest_ip)

[JSkier]

That works! Thank you.

[JSkier]

So, I think I'm over thinking this. Here is one way to get this to work. There is some inherent inefficiency with this, but it works (ideally I would only merge blocks of IPs which match my criteria). I'll look into the cidrmatch function, that may help.

eval ipaddress=mvappend(src_ip,dest_ip)