Implementing Splunk 7 - Third Edition

CIDR wildcard lookups

CIDR wildcards look very similar to text-based wildcards but use Classless Inter-Domain Routing (CIDR) rules to match lookup rows against an IP address.

Let's try an example. Say we have this lookup file:

ip_range,network,datacenter 
10.1.0.0/16,qa,east 
10.2.0.0/16,prod,east 
10.128.0.0/16,qa,west 
10.129.0.0/16,prod,west 

It has this corresponding definition in transforms.conf:

[ip_address_lookup] 
filename = ip_address_lookup.csv 
match_type = CIDR(ip_range) 
max_matches = 1 

And, there are a few events such as these:

src_ip=10.2.1.3 user=mary 
src_ip=10.128.88.33 user=bob 
src_ip=10.1.35.248 user=bob 

We could use lookup to enrich these events as follows:

src_ip="*" | lookup ip_address_lookup ip_range as src_ip | table src_ip ...