How do I specify a search on a certain subnet?
You can also try this:
src_IP=192.168.1.0/24
Try the solution from this post:
http://answers.splunk.com/answers/23554/cidr-match
Have you tried cidrmatch?
http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/CommonEvalFunctions