Splunk Search

Finding the correct scope of an IP address?

dersa
Path Finder

Hi, I am struggling with following task. I have a lookup file containing all the configured dhcp scopes in the following format. 

ScopeId SubnetMask Name State StartRange EndRange LeaseDuration

In the dhcp.log i have the ip address for a client. 

I need the ScopeID and the LeaseDuration for each client. 

My idea is to look if the given IP Address is within StartRange and EndRange and get the ScopeID and LeaseDuration. My problem is I don't have a clue on how to do so.

Any Ideas?

thanks 

Alex

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Are you IP ranges CIDR ranges, if so, you can make a lookup definition based on that CSV with the CIDR range as a single field in the lookup. In the match advanced options for the lookup definition, set CIDR(range_field) where range_field in the field containing the CIDR range.

Then in your SPL do

<search>
| lookup dhcp_scopes range_field as ip

which will lookup ip against the CIDR range in the lookup

If you cannot do CIDR, then it becomes a little more complicated. You will have to work out if you can segregate your lookup rows into stem+range for groups of IP addresses. e.g.

base=10.1.8, start=1, end=63
base=10.1.8, start=128, end=192
base=10.2.8, start=1, end=63

You'll then need to break up the IP to make a match and the possibly get multiple results back. It's possible but a little fiddly.

0 Karma

dersa
Path Finder

Thanks, 

I'll give it a shot.

Best regards

Alex

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...