Hi,
Why my CIDR matching in not following the lookup content?
Query i used is as below:
| makeresults
| eval ip="10.10.10.10"
| lookup testip ip OUTPUTNEW description
Result should look like this:
ip | Description |
10.10.10.10 | New |
But the real output look like this:
ip | Description |
10.10.10.10 | New In Progress Closed |
I have check my lookup and its clearly state the Description for IP Range 10.10.10.10/27 is "New".
Please help and thanks!
About 3, for example, if your lookup is like this:
ip | Description |
10.10.10.10/27 | New |
10.10.10.0/24 | In Progress |
10.10.8.0/16 | Closed |
10.10.10.10 will match all three.
Post the output of:
| inputlookup testip
If its to long post part with IP 10.10.10.x