I am attempting to use splunk to look up IP addresses that users punch in to our system. The reason for this is to find out what network they are on in correlation to our security policies. I am currently doing this in a look up table, but I am looking to be able to set the ip address value, and just look up the CIDR match in the lookup table.
I have that transform already written, and the transform is working successfully.
Basically, i am looking to have my users be able to type in "ip_addr= < set by user > | lookup ip__lookup" into a query bar, and have it use the lookup table to do the CIDR match, and turn out the network name as the value.
I know there are very talented people on here, so i'm looking for any suggestions you have!
Thank you!