Splunk Search

Is it possible to do a CIDR match in a tstats where clause?

IgorB
Path Finder

Is it possible to match IP address range in tstats where clause?

Example:
It's possible to do this with search+stats:

index=test IP="10.1.1.0/25" | stats count by IP

But since we have IP extracted at index time, I'd rather take advantage of tstats performance and run something like

| tstats count where index=test IP="10.1.1.0/25" by IP

but that doesn't work as expected - tstats matches any IP as if the filter was IP="*"
Ideas?

0 Karma
1 Solution

woodcock
Esteemed Legend

Actually, natural CIDR filters work in tstats.

Like this:

| tstats count FROM datamodel=Network_Traffic WHERE index=* AND All_Traffic.src="10.0.0.0/8"

And this:

| tstats count WHERE index=* AND host="10.0.0.0/8"

This has been in Splunk for a long time, but maybe not always. It works in all versions of 7.*

View solution in original post

woodcock
Esteemed Legend

Actually, natural CIDR filters work in tstats.

Like this:

| tstats count FROM datamodel=Network_Traffic WHERE index=* AND All_Traffic.src="10.0.0.0/8"

And this:

| tstats count WHERE index=* AND host="10.0.0.0/8"

This has been in Splunk for a long time, but maybe not always. It works in all versions of 7.*

astatrial
Contributor

Is the negative form suppose to work as well? 

 

For example:

| tstats count FROM datamodel=Network_Traffic WHERE index=* AND All_Traffic.src!="10.0.0.0/8"

 

Tags (1)
0 Karma

dshpritz
SplunkTrust
SplunkTrust

tstats is not CIDR aware for where clauses. Sorry 😞

IgorB
Path Finder

Apparently this is no longer true in Splunk v.7.x.
Thanks to @woodcock for pointing this out

0 Karma

gcusello
SplunkTrust
SplunkTrust

I think that you already used the tscollect (eg.g. in test_stats) command before use tstats, something like this

   index=test earliest=-30d latest=now | table _time IP field1 field2 field3 ... | tscollect test_stats

so the command could be:

  | tstats count FROM tests_stats GROUPBY IP

Bye.
Giuseppe

IgorB
Path Finder

I downvoted this post because:
Sorry, can't accept. your reply doesn't answer my question:
1. your assumption that I've used '| tscollect' is incorrect
2. '| tstats ... ' you proposed misses the point of returning only ips in a specific range

0 Karma

gcusello
SplunkTrust
SplunkTrust

if you're satisfied of the answer, please, accept the answer.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...