Hi All,
I have a lookup that currently works. I've set match_type to CIDR(netRange) in my transforms file and everything works when I pass it an IP address to find in the range.
However, I'm looking to use this lookup table without a search. So I went with the creating command inputlookup
, but for the life of me, I cannot get a CIDR match to work. I want to pass it an IP, and have it find the matching CIDR notation in netRange.
Is there no way to do this with the inputlookup command — why is it not honoring my transform?
This works:
index="main" | eval cip="1.1.1.1" | lookup IP2ASN netRange AS cip
This does not work
|inputlookup IP2ASN where netRange=1.1.1.1
Try this
| makeresults | eval cip="1.1.1.1" | lookup IP2ASN netRange AS cip
Try this
| makeresults | eval cip="1.1.1.1" | lookup IP2ASN netRange AS cip
Gold! thank you, and to be clear... I'm not actually issuing a search with "makeresults"?
You're running a search command that generates a dummy row (not searching actual indexes). Technically it's still a search.
It'll do, thanks again.
@adepasquale Try this-
|inputlookup IP2ASN | where netRange="1.1.1.1"
This doesn't work either. netRange has values like 1.0.0.0/24, 1.0.1.0/24, 1.1.1.0/24, etc...