https://community.splunk.com/t5/Knowledge-Management/Create-a-wildcard-string-from-cidr-values-for-TERM-matching/m-p/478409#M4519 <P>Create a wildcard string for a TERM match to a cidr or list of cidrs.</P> <P>This way you can search indexes or datamodels like this: index=myindex TERM(192.168.0.*) from the cidr 192.168.0.0/24</P> Sun, 07 Jun 2020 23:12:04 GMT landen99 2020-06-07T23:12:04Z https://community.splunk.com/t5/Knowledge-Management/Create-a-wildcard-string-from-cidr-values-for-TERM-matching/m-p/478409#M4519 <P>Create a wildcard string for a TERM match to a cidr or list of cidrs.</P> <P>This way you can search indexes or datamodels like this: index=myindex TERM(192.168.0.*) from the cidr 192.168.0.0/24</P> Sun, 07 Jun 2020 23:12:04 GMT https://community.splunk.com/t5/Knowledge-Management/Create-a-wildcard-string-from-cidr-values-for-TERM-matching/m-p/478409#M4519 landen99 2020-06-07T23:12:04Z https://community.splunk.com/t5/Knowledge-Management/Create-a-wildcard-string-from-cidr-values-for-TERM-matching/m-p/478410#M4520 <P>The following macro displays the wildcard string matches to a given CIDR:</P> <PRE><CODE> rex field=cidr "^(?&lt;ip_base&gt;[\d\.]{7,})\/(?&lt;ip_block&gt;\d{1,2})$" | rex field=ip_base "(?&lt;ip1&gt;\d+)\.(?&lt;ip2&gt;\d+)\.(?&lt;ip3&gt;\d+)" | eval ip2B=case(ip_block&lt;=8,"*",ip_block=16,ip2,ip_block=15,mvrange(ip2,ip2+2),ip_block=14,mvrange(ip2,ip2+4),ip_block=13,mvrange(ip2,ip2+8),ip_block=12,mvrange(ip2,ip2+16),ip_block=11,mvrange(ip2,ip2+32),ip_block=10,mvrange(ip2,ip2+64),ip_block=9,mvrange(ip2,ip2+128),1=1,ip2) | eval ip3B=case(ip_block&lt;=16,"*",ip_block=16,ip3,ip_block=23,mvrange(ip3,ip3+2),ip_block=22,mvrange(ip3,ip3+4),ip_block=21,mvrange(ip3,ip3+8),ip_block=20,mvrange(ip3,ip3+16),ip_block=19,mvrange(ip3,ip3+32),ip_block=18,mvrange(ip3,ip3+64),ip_block=17,mvrange(ip3,ip3+128),1=1,ip3) | mvexpand ip2B | mvexpand ip3B | eval ip_wildcard=ip1.".".ip2B.".".ip3B.".*" | fields - ip1* ip2* ip3* cidr_wildcard </CODE></PRE> Mon, 20 Apr 2020 20:49:27 GMT https://community.splunk.com/t5/Knowledge-Management/Create-a-wildcard-string-from-cidr-values-for-TERM-matching/m-p/478410#M4520 landen99 2020-04-20T20:49:27Z