topic Re: How does cidrmatch work? in Splunk Dev https://community.splunk.com/t5/Splunk-Dev/How-does-cidrmatch-work/m-p/490410#M8815 <P>Very kind @harsmarvania57 - please convert to an answer...</P> Thu, 26 Sep 2019 14:32:13 GMT danielbb 2019-09-26T14:32:13Z How does cidrmatch work? https://community.splunk.com/t5/Splunk-Dev/How-does-cidrmatch-work/m-p/490407#M8812 <P>The following code -</P> <PRE><CODE>| eval ipa="10.22.3.2" | eval ret=if(cidrmatch("10.0.0.0/8", ipa), "tr", "fl") | return ret </CODE></PRE> <P>Returns -</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7740i59B3F066DD5CCA0F/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Why is that?</P> Thu, 26 Sep 2019 13:29:20 GMT https://community.splunk.com/t5/Splunk-Dev/How-does-cidrmatch-work/m-p/490407#M8812 danielbb 2019-09-26T13:29:20Z Re: How does cidrmatch work? https://community.splunk.com/t5/Splunk-Dev/How-does-cidrmatch-work/m-p/490408#M8813 <P>Ok, </P> <P>by adding the <CODE>makeresults</CODE></P> <PRE><CODE>| makeresults | eval ipa="10.22.3.2" | eval ret=if(cidrmatch("10.0.0.0/8", ipa), "tr", "fl") | return ret </CODE></PRE> <P>I get <CODE>ret="tr"</CODE>.</P> <P>Not sure whether <CODE>ret="tr"</CODE> is correct... </P> Thu, 26 Sep 2019 13:44:41 GMT https://community.splunk.com/t5/Splunk-Dev/How-does-cidrmatch-work/m-p/490408#M8813 danielbb 2019-09-26T13:44:41Z Re: How does cidrmatch work? https://community.splunk.com/t5/Splunk-Dev/How-does-cidrmatch-work/m-p/490409#M8814 <P>It is correct, because IP <CODE>10.22.3.2</CODE> belongs to CIDR Range <CODE>10.0.0.0/8 -&gt; 10.0.0.0-10.255.255.255</CODE></P> Thu, 26 Sep 2019 14:14:20 GMT https://community.splunk.com/t5/Splunk-Dev/How-does-cidrmatch-work/m-p/490409#M8814 harsmarvania57 2019-09-26T14:14:20Z Re: How does cidrmatch work? https://community.splunk.com/t5/Splunk-Dev/How-does-cidrmatch-work/m-p/490410#M8815 <P>Very kind @harsmarvania57 - please convert to an answer...</P> Thu, 26 Sep 2019 14:32:13 GMT https://community.splunk.com/t5/Splunk-Dev/How-does-cidrmatch-work/m-p/490410#M8815 danielbb 2019-09-26T14:32:13Z