Splunk Search

How to set a field value and leverage a lookup table?

tmarlette
Motivator

I am attempting to use splunk to look up IP addresses that users punch in to our system. The reason for this is to find out what network they are on in correlation to our security policies. I am currently doing this in a look up table, but I am looking to be able to set the ip address value, and just look up the CIDR match in the lookup table.

I have that transform already written, and the transform is working successfully.

Basically, i am looking to have my users be able to type in "ip_addr= < set by user > | lookup ip__lookup" into a query bar, and have it use the lookup table to do the CIDR match, and turn out the network name as the value.

I know there are very talented people on here, so i'm looking for any suggestions you have!

Thank you!

Tags (2)
0 Karma

Ayn
Legend

Well, either I understand your question incorrectly, or the answer is pretty simple.

Splunk can match on CIDR ranges in lookups. Just specify in your lookup definition in transforms.conf that the match type should be CIDR:

match_type = <string>
* A comma and space-delimited list of <match_type>(<field_name>) specification to allow for non-exact matching
* The avaiable match_type values are WILDCARD, CIDR, and EXACT.  EXACT is the default and does not need to be specified.  Only fields that should use WILDCARD or CIDR matching should be specified in this list

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf

0 Karma

tmarlette
Motivator

I'm probably not be explaining it properly.

Basically I just want to plug in an IP address, and look up say something like the the geo-ip information.

Let's say I get a phone call and somebody gives me their IP address. I would like to plug that IP into splunk, and have it return say the city, state and zip. does that make sense?

In this use case, i'm just looking to use this for it's look up feature.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...