topic Re: Exclude CIDR range from search results in Getting Data In

Exclude CIDR range from search results

shiftey — Tue, 02 Jun 2015 23:06:20 GMT

Hi Splunk Answers,

I want to exclude IP addresses from certain networks in search results. The range is 10.52.0.0/24 - 10.52.40.0/24.

If I want to exclude using one range I would use

| where NOT cidrmatch("10.52.0.0/24")

How would I exclude multiple ranges?

Re: Exclude CIDR range from search results

stephanefotso — Wed, 03 Jun 2015 12:56:36 GMT

Here you go:

  ... |where (NOT cidrmatch("10.52.0.0/24",ipfield) AND NOT cidrmatch("10.52.40.0/24",ipfield))|table ipfield

Thanks

Re: Exclude CIDR range from search results

ptate — Fri, 02 Nov 2018 18:10:50 GMT

What if I wanted to use a lookup table for this? I have a lookup table of just a list of CIDR blocks and I want to exclude them when searching.

Re: Exclude CIDR range from search results

landen99 — Thu, 18 Apr 2019 18:10:54 GMT

1) Create a lookup table of cidr blocks
2) Create a lookup definition with the CIDR advanced option for matching
3) Use the lookup command and NOT out_field=*

index=... | lookup my_def in_field OUTPUT out_field | search NOT out_field=*

Re: Exclude CIDR range from search results

morethanyell — Wed, 30 Oct 2019 04:03:45 GMT

Check this app I created.

on Bitbucket: https://bitbucket.org/intalock/incidr/src/master/
on Github : https://github.com/morethanyell/incidr

This is an app I created that accepts multiple cidr blocks