sonar-matchnet-by-ip-batch
Enrich each record with the network subnets that contain its IP address, searching every subnet group at once.
A record whose address sits in several overlapping subnets is emitted once per subnet, keeping all of its original fields. The subnet catalog is read once when the query starts, so an edit made while it runs is not seen. Sonar stores subnets as IPv4 only; an IPv6 or unparseable value simply does not match.
Syntax
sonar-matchnet-by-ip-batch [field=FIELD] [fields=FIELDS] [keywords=KEYWORDS] [limit=NUM] [drop=DROP]
Options
- field=FIELD
- Optional. Name of the field holding the IP address. Specify either field or fields
- fields=FIELDS
- Optional. Comma separated field names holding IP addresses. Specify either field or fields
- keywords=KEYWORDS
- Optional. Space separated search terms that narrow the subnet catalog, matched against the subnet group name and description, or against the subnet description
- limit=NUM
- Optional. Maximum number of matched rows to emit per input record (default: no limit)
- drop=DROP
- Optional. t: emit only matched records. f: pass an unmatched record through unchanged (default)
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| subnet_field | String | Matched field | Field the address came from |
| subnet_value | IP address | Matched value | Address that matched |
| subnet_group_guid | String | Group GUID | Subnet group GUID |
| subnet_group_name | String | Group name | Subnet group name |
| subnet_group_description | String | Group description | Subnet group description |
| subnet_id | Integer | Subnet ID | Subnet entry ID |
| subnet_start_ip | IP address | Start IP | First address of the subnet |
| subnet_end_ip | IP address | End IP | Last address of the subnet, computed from the prefix when stored as a CIDR block |
| subnet_cidr | Integer | CIDR | Prefix length, or null when the subnet was stored as a range |
| subnet_description | String | Description | Subnet description |
| subnet_app_code | String | App code | Code of the app that owns the subnet, or null when it was added by hand |