Splunk unable to lookups

Question

I want to filter the search by matching IP address to subnet masks. I extracted the ip_address field.

I created lookup table file named AP-Subnet.csv

subnets,ap
10.24.0.0/14,YES
163.243.193.0/24,YES
10.120.250.0/24,YES
10.124.248.0/21,YES

Then I created lookup definition AP_subnet_lookups

lookup definition AP_subnet_lookups

This is my search

sourcetype="logs" |transaction ip_address |lookup AP_subnet_lookups subnets |table eventcount ip_address hostname

The search result contains other ip addresses that doesn't match the masks.

How should I change my search?

hobbes3 · Accepted Answer · 2014-03-11 23:43:06Z

1

Set match_type = CIDR(subnets) in transforms.conf.

Your transforms.conf is probably located in $SPLUNK_HOME/etc/apps/search/local/ if you modified your lookup via GUI while within the search app.

If you can't find it then locate it using ./splunk cmd btool transforms list --debug.

answered Mar 11, 2014 at 23:43

hobbes3

30.8k24 gold badges92 silver badges120 bronze badges

Sign up to request clarification or add additional context in comments.

1 Answer 1