Splunk Search

How does one search for a CIDR range of addresses?

samalchow
New Member

If I want to search for a range of addresses, say anything in 10.0.1.0/24 from anywhere in the log, how do you do that? I can't find anything that works.

Tags (1)
0 Karma

lball
Explorer

You can frame the search with wild cards. Example: src_ip=10.1.2.[wcrd] for a /24 CIDR range or src_ip=10.7.[wcrd].[wcrd] for a /16 CIDR range, etc.

[wcrd] = *

(I was having trouble getting the * to show when using more than 1 in the IP addresses.)

dfrankekcg
Explorer

If the IP ranges are consecutive you can use an online CIDR calculator to get the CIDR notation to use. Example: to search where src_ip is between 127.0.120.0 and 127.0.122.0, use src_ip=127.0.120.0/23

Ayn
Legend

You can't do CIDR defined search on freetext. You can however do it if you have the IP addresses you want to match against in extracted fields. In other words,

10.0.0.0/24

won't work, but

src_ip=10.0.0.0/24

will.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...