Hi,
I want to find the IP address : 10.1.4.0 to 10.1.41.128 on Splunk Search.
Is there an efficient query than OR ? (index=sources_Ip (sources_ip="10.1.4.0" OR sources_ip="10.1.4.1" OR sources_ip="1.1.4.2" OR ...) )
Thanks
S.V
You could use wildcards to simplify the query.
index=sources_Ip sources_ip="10.1.*"
Or perhaps you can use CIDRs.
index=sources_Ip | where (cidrmatch("10.1.4.0/24", sources_ip) OR cidrmatch("10.1.5.0/24", sources_ip) ...) | ...
You could use wildcards to simplify the query.
index=sources_Ip sources_ip="10.1.*"
Or perhaps you can use CIDRs.
index=sources_Ip | where (cidrmatch("10.1.4.0/24", sources_ip) OR cidrmatch("10.1.5.0/24", sources_ip) ...) | ...
Just a note -- you can also run CIDR matches in the base search. E.g., index=sources_Ip sources_ip=10.1.4.0/24 OR sources_ip=10.1.5.0/24
.