Splunk Search

Match IP's in Splunk against IP ranges in decimal format in CSV

spark2310
Explorer

I have a field in Splunk that contains IPs such as 223.xx.xxx.1
query: index=traffic_logs ip_address=*|timechart span=1h count by ip_address

I want to write a query to timechart ips traffic that match in one of the ranges in the csv file below (it had ip ranges in decimal format), so the ip above should return http://thegigabit.com since it exists in the range.

(( 3743019008, -----> this is actually 223.25.240.0 if converted to IP format
3743020031, -----> range end 223.25.243.255
'http://thetestbit.com/'),
( 3743020288,
3743021055,
'http://thetestbit.com/'),
( 3743131648,
3743133695,
'http://www.test.net/'))

0 Karma

nikita_p
Contributor

Hi @spark2310,
One question i have..
Does ips such as 223.25.240.1 are present in your csv file? Because we will need one common field like this ip in both your logs and csv file.

0 Karma

niketn
Legend

@spark2310, please try the following run anywhere search which converts IP Address from Dot Decimal format to Integer IP format. (PS: You can remove first two pipes |makeresults and | eval ip_address... and replace with your current SPL with timechart to convert ip_address from your raw data to ip_address_integer which can be passed to lookup file.)

| makeresults
| eval ip_address = "223.25.240.0"
| eval ip_dot_decimal_split=split(ip_address,".")
| eval first=mvindex(ip_dot_decimal_split,0),second=mvindex(ip_dot_decimal_split,1),third=mvindex(ip_dot_decimal_split,2),fourth=mvindex(ip_dot_decimal_split,3)
| fields - ip_dot_decimal_split
| eval first=first*pow(256,3),second=second*pow(256,2),third=third*256
| eval ip_address_integer=first+second+third+fourth
| fields - first,second,third,fourth

PS: Also once you have tested and compare ip_address to corresponding ip_address_integer, towards the end of the search ip_address_integer can be actually called as ip_address to avoid creating of an additional field. Afterwards, you can consider saving the conversion command as a Macro so that it is persisted as a knowledge object for easier maintenance and re-usability.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

MattKr
Explorer

That's exactly what i was looking for,  thanks for that.

0 Karma

niketn
Legend

@spark2310, were you able to try out the example? Is your issue resolved?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...