Splunk Search

How do I match an IP address to a range that spans multiple CIDRs?

scottrunyon
Contributor

I am trying to match IP addresses in the block of addresses - 10.120.1.0 through 10.120.13.255. This range spans several CIDR ranges
10.120.1.0/24 + 10.120.2.0/23 + 10.120.4.0/22 + 10.120.8.0/22 + 10.122.12.0/23. Is there a way to search not using eval cidrmatch?

1 Solution

Raschko
Communicator

You could use a regex command to check if the ip matches the pattern and filter for these events

| regex ip="10.120.(?:[1-9]|1[0-3]).[0-255]"

Alternatively, you can just use cidrmatch with the case command.

| eval match=case(
cidrmatch("10.120.1.0/24" ,ip) ,"1",
cidrmatch("10.120.2.0/23" ,ip) ,"1",
cidrmatch("10.120.4.0/22" ,ip) ,"1",
cidrmatch("10.120.8.0/22" ,ip) ,"1",
cidrmatch("10.120.12.0/23",ip),"1",
1=1,"0")

HTH,
Raschko

View solution in original post

Raschko
Communicator

You could use a regex command to check if the ip matches the pattern and filter for these events

| regex ip="10.120.(?:[1-9]|1[0-3]).[0-255]"

Alternatively, you can just use cidrmatch with the case command.

| eval match=case(
cidrmatch("10.120.1.0/24" ,ip) ,"1",
cidrmatch("10.120.2.0/23" ,ip) ,"1",
cidrmatch("10.120.4.0/22" ,ip) ,"1",
cidrmatch("10.120.8.0/22" ,ip) ,"1",
cidrmatch("10.120.12.0/23",ip),"1",
1=1,"0")

HTH,
Raschko

CryoHydra
Path Finder

Hello @Raschko wht this section of code 1=1,"0" on eval doing . Thanks

0 Karma

scottrunyon
Contributor

The eval answer is just exactly what I needed. I need to have several other sub-nets defined and this lets me expand to cover all of them.

Thanks for the help!!

Scott

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...