Splunk Search

Finding the correct scope of an IP address?

dersa
Path Finder

Hi, I am struggling with following task. I have a lookup file containing all the configured dhcp scopes in the following format. 

ScopeId SubnetMask Name State StartRange EndRange LeaseDuration

In the dhcp.log i have the ip address for a client. 

I need the ScopeID and the LeaseDuration for each client. 

My idea is to look if the given IP Address is within StartRange and EndRange and get the ScopeID and LeaseDuration. My problem is I don't have a clue on how to do so.

Any Ideas?

thanks 

Alex

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Are you IP ranges CIDR ranges, if so, you can make a lookup definition based on that CSV with the CIDR range as a single field in the lookup. In the match advanced options for the lookup definition, set CIDR(range_field) where range_field in the field containing the CIDR range.

Then in your SPL do

<search>
| lookup dhcp_scopes range_field as ip

which will lookup ip against the CIDR range in the lookup

If you cannot do CIDR, then it becomes a little more complicated. You will have to work out if you can segregate your lookup rows into stem+range for groups of IP addresses. e.g.

base=10.1.8, start=1, end=63
base=10.1.8, start=128, end=192
base=10.2.8, start=1, end=63

You'll then need to break up the IP to make a match and the possibly get multiple results back. It's possible but a little fiddly.

0 Karma

dersa
Path Finder

Thanks, 

I'll give it a shot.

Best regards

Alex

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...