Splunk Search

lookup file with a mix of ranges of IP and unique IP

faribole
Path Finder

Hi all

I use a lookup file with a mix of ranges of IP and unique IP to count events of login

My file is like this

ip,entity
10.0.1.0/24, A
10.0.2.0/24, B
12.0.0.4,C
12.0.0.8,C

I configure my lookup file with CIDR option but the result of search only extract the
events of ip integrated in ranges of ip.

I woulld like to extract all the results

how can I solved this with only one lookup file ?

0 Karma

nickhills
Ultra Champion

You need all addresses in your lookup to be in CIDR notation, that means your lookup should look like this.

ip,entity
10.0.1.0/24,A
10.0.2.0/24,B
12.0.0.4/32,C
12.0.0.8/32,C
If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...