Splunk Search

lookup file with a mix of ranges of IP and unique IP

faribole
Path Finder

Hi all

I use a lookup file with a mix of ranges of IP and unique IP to count events of login

My file is like this

ip,entity
10.0.1.0/24, A
10.0.2.0/24, B
12.0.0.4,C
12.0.0.8,C

I configure my lookup file with CIDR option but the result of search only extract the
events of ip integrated in ranges of ip.

I woulld like to extract all the results

how can I solved this with only one lookup file ?

0 Karma

nickhills
Ultra Champion

You need all addresses in your lookup to be in CIDR notation, that means your lookup should look like this.

ip,entity
10.0.1.0/24,A
10.0.2.0/24,B
12.0.0.4/32,C
12.0.0.8/32,C
If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...