Knowledge Management

Automatic lookup, matching range field?

drejoe
Explorer

Hi,

I would like to enriche netflow data (i.e. dst ip, dst port) with "service name", using automatic lookup.
My lookup looks like the following example:

IP             PORT_RANGE         SERVICENAME
x.x.x.x/32     1024,1048          ServiceA
y.y.y.y/30     80,80              ServiceB
z.z.z.z/31     8000,8999          ServiceC

OR the lookup could be with two PORT fields:

IP             PORT_MIN      PORT_MAX     SERVICENAME
x.x.x.x/32     1024          1048         ServiceA
y.y.y.y/30     80            80           ServiceB
z.z.z.z/31     8000          8999         ServiceC

Matching the IP is easy with match_type CIDR, BUT how-to match the port range???
Don't mind which of the two examples above to implement a solution for 😉
Or the solution could be a complete 3th solution.

Looking forward fore some bright answers,
Thanks,
//Torben

0 Karma

JDukeSplunk
Builder

It sounds like a job for a lookup table. I don't know if you can do ranges in a lookup table..

https://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/LookupexampleinSplunkWeb

You may have to have a line entry for each port in the csv file to get it working. Not the best solution, but it is simple and might be the only solution.

So your csv lookup file might look like... And with excel if you enter two cells with consecutive numbers, you can click the corner and drag down to populate up to the number you like.

port,servicename
1024,ServiceA
1025,ServiceA
1026,ServiceA
1027,ServiceA
1028,ServiceA
1029,ServiceA
1030,ServiceA
1031,ServiceA
1032,ServiceA

etc...

Then you can either do an inline |inputlookup or do an automatic search that will create a new field called "ServiceName" or whatever.

0 Karma

drejoe
Explorer

Hi,

Thanks for the answer.

I've already tried this solution (before posting the question) with one line per port. But the amount of combinations is huge - millions of lines which won't work at all.

That's why I need another solution - a solution that can handle this ranges instead of "unfolding" all combinations.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...