Splunk Search

How do I match an IP address to a range that spans multiple CIDRs?

scottrunyon
Contributor

I am trying to match IP addresses in the block of addresses - 10.120.1.0 through 10.120.13.255. This range spans several CIDR ranges
10.120.1.0/24 + 10.120.2.0/23 + 10.120.4.0/22 + 10.120.8.0/22 + 10.122.12.0/23. Is there a way to search not using eval cidrmatch?

1 Solution

Raschko
Communicator

You could use a regex command to check if the ip matches the pattern and filter for these events

| regex ip="10.120.(?:[1-9]|1[0-3]).[0-255]"

Alternatively, you can just use cidrmatch with the case command.

| eval match=case(
cidrmatch("10.120.1.0/24" ,ip) ,"1",
cidrmatch("10.120.2.0/23" ,ip) ,"1",
cidrmatch("10.120.4.0/22" ,ip) ,"1",
cidrmatch("10.120.8.0/22" ,ip) ,"1",
cidrmatch("10.120.12.0/23",ip),"1",
1=1,"0")

HTH,
Raschko

View solution in original post

Raschko
Communicator

You could use a regex command to check if the ip matches the pattern and filter for these events

| regex ip="10.120.(?:[1-9]|1[0-3]).[0-255]"

Alternatively, you can just use cidrmatch with the case command.

| eval match=case(
cidrmatch("10.120.1.0/24" ,ip) ,"1",
cidrmatch("10.120.2.0/23" ,ip) ,"1",
cidrmatch("10.120.4.0/22" ,ip) ,"1",
cidrmatch("10.120.8.0/22" ,ip) ,"1",
cidrmatch("10.120.12.0/23",ip),"1",
1=1,"0")

HTH,
Raschko

CryoHydra
Path Finder

Hello @Raschko wht this section of code 1=1,"0" on eval doing . Thanks

0 Karma

scottrunyon
Contributor

The eval answer is just exactly what I needed. I need to have several other sub-nets defined and this lets me expand to cover all of them.

Thanks for the help!!

Scott

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...