Splunk Search

How to create a new internal IP field, at search time, from src and dest IP fields?

JSkier
Communicator

I'd like to create a field at search time, we'll call it internal_ip. I can already filter by CIDR block and get the results I want, but I need more depth than that for a lookup I'd like to do. The problem is with my IDS logs, depending on the directional flow, the internal IP can be either src_ip or dest_ip (this particular search will never return both internal IP addresses). I'd like a query to search both src_ip and dest_ip fields for a specific private network IP block, and assign that value to my new field. How do I accomplish this?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

What you need is a calculated field which will take the first non-null value from src_ip and dest_ip field and assign to internal_ip field. More info here. http://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/definecalcfields

props.conf

[yoursourcetype]
EVAL-internal_ip = coalesce(src_ip,dest_ip)

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

What you need is a calculated field which will take the first non-null value from src_ip and dest_ip field and assign to internal_ip field. More info here. http://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/definecalcfields

props.conf

[yoursourcetype]
EVAL-internal_ip = coalesce(src_ip,dest_ip)
0 Karma

JSkier
Communicator

Thanks for the quick response, but coalesce takes the first non-null value, which means data will be missing. I imagine it will be a more complicated query.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

In an event, you'll have either src_ip OR dest_ip right? So it'll take whatever is available. Easiest option is the run following query and check.

your base search for yoursourcetype | table src_ip dest_ip | eval internal_ip = coalesce(src_ip,dest_ip)
0 Karma

JSkier
Communicator

I need to clarify, there will always be one src and one dest IP. What I meant to say is, there will never be an internal IP for BOTH src and dest IPs. Basically one IP will always be internal, and the other will always be external. Sorry for the confusion.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

So if you've a way to identify the internal ip, may using the subnet, then you can use a cidrmatch("X",Y) function in eval to check which one is the internal ip and use that. Like this (using sample ip subnet)

props.conf

[yoursourcetype]
EVAL-internal_ip= if(cidrmatch("123.132.32.0/25",src_ip),src_ip,dest_ip)
0 Karma

JSkier
Communicator

That works! Thank you.

0 Karma

JSkier
Communicator

So, I think I'm over thinking this. Here is one way to get this to work. There is some inherent inefficiency with this, but it works (ideally I would only merge blocks of IPs which match my criteria). I'll look into the cidrmatch function, that may help.

eval ipaddress=mvappend(src_ip,dest_ip)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...