Splunk Search

Match IP address to IP range with a lookup

spark2310
Explorer

I have an index=logs that has an ip_address field like 5.9.100.100
I want to correlate it against a csv file that has list of ip ranges to see owner. first field contains range beginning and second is range end. so in case of 5.9.100.100, it should match with csv file below

Is there a way to lookup csv ip ranges and join on ip_address field in index=logs? Also, if csv file contained IP range in CIDR format instead, would this be a better way to lookup against?

5.9.0.0 5.9.255.255 Owner1
5.10.64.0 5.10.127.255 Owner2

0 Karma

starcher
SplunkTrust
SplunkTrust

For lookups to use CIDR the address column in your lookup must be in CIDR notation. And you need to define the field as a CIDR lookup as in this answers post.

https://answers.splunk.com/answers/5916/using-cidr-in-a-lookup-table.html

spark2310
Explorer

So only way is to convert ranges to a CIDR format in all the csv file?

0 Karma

starcher
SplunkTrust
SplunkTrust

If you want to do the lookup based on network ranges yes. Otherwise you are looking up by string matching what happens to also be an IP.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...