Splunk Search

How does one search for a CIDR range of addresses?

samalchow
New Member

If I want to search for a range of addresses, say anything in 10.0.1.0/24 from anywhere in the log, how do you do that? I can't find anything that works.

Tags (1)
0 Karma

lball
Explorer

You can frame the search with wild cards. Example: src_ip=10.1.2.[wcrd] for a /24 CIDR range or src_ip=10.7.[wcrd].[wcrd] for a /16 CIDR range, etc.

[wcrd] = *

(I was having trouble getting the * to show when using more than 1 in the IP addresses.)

dfrankekcg
Explorer

If the IP ranges are consecutive you can use an online CIDR calculator to get the CIDR notation to use. Example: to search where src_ip is between 127.0.120.0 and 127.0.122.0, use src_ip=127.0.120.0/23

Ayn
Legend

You can't do CIDR defined search on freetext. You can however do it if you have the IP addresses you want to match against in extracted fields. In other words,

10.0.0.0/24

won't work, but

src_ip=10.0.0.0/24

will.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...