Splunk Search

Can search sytax use the notation of network mask like /24

hjwang
Contributor

Dear all, i wanna filter the specific ip range for one country, can search sytax use the notation of network mask like /24, for instance, the ip range from 110.77.0.0 to 110.77.127.255, i hope i can use 110.77.0/17 rather than 110.77.0.~110.77.127. as filter condition. Any other better suggestions?Thanks

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Yes, you can, but only as a field value match, i.e., you can search for ipaddr=110.77.0.0/23 but not for just 110.77.0.0/23.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Yes, you can, but only as a field value match, i.e., you can search for ipaddr=110.77.0.0/23 but not for just 110.77.0.0/23.

usethedata
Path Finder

@southeringtonp -- Thank you for posting the cross-reference. That second question is exactly what I needed.

0 Karma

sdwilkerson
Contributor

You rock Gerald!

0 Karma

southeringtonp
Motivator

You can also use cidrmatch in the eval command. If you are dealing with known (usually internal) subnets, you can also resolve them by name - see this thread: http://answers.splunk.com/questions/5916/using-cidr-in-a-lookup-table

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...