topic Re: specific ip remove sql questio in Dashboards & Visualizations

specific ip remove sql questio

nnonm111 — Tue, 13 Apr 2021 04:58:03 GMT

index = "fw"src_ip = "192.168.10. *"
| rex "192 \ .168 \ .10 \. (? <범위> \ d {1,3})"
| 여기서 범위> = 11 AND 범위 <= 126
| 중복 제거 src_ip
| stats count

나는 위의 명령에서 ip를 얻고 있습니다.
192.168.10.16, 192.168.10.21, 192.168.10.26, 192.168.10.31 ~ 192.168.10.126의 네 가지 IP를 살펴보고 싶습니다. 방법이 있습니까?

Re: specific ip remove sql questio

scelikok — Tue, 13 Apr 2021 04:36:14 GMT

Hi @nnonm111,

You question is not clear, could you please tell us what do you want to do with that four ip? (The list has actually five ips)

Re: specific ip remove sql questio

nnonm111 — Tue, 13 Apr 2021 04:56:51 GMT

After 192.168.10.11 we would like to exclude 4 ip(192.168.10.12,13,14,15) by 192.168.10.126.

Output value:
192.168.10.11
192.168.10.16
192.168.10.21
.
.
.
192.168.10.126

Re: specific ip remove sql questio

scelikok — Tue, 13 Apr 2021 05:42:24 GMT

You can use regex to filter those ip addresses, please try below;

| regex src_ip!="192\.168\.10\.1[2-5]"

Re: specific ip remove sql questio

nnonm111 — Tue, 13 Apr 2021 06:06:47 GMT

The sql does not fit.

index=fw
filed=src_ip

python code
a = '192.168.11.'

for i in range(11,127,5):
ip = str(a)+str(i)
print(ip)

Can the pyhton be expressed in sql?

Re: specific ip remove sql questio

scelikok — Tue, 13 Apr 2021 11:01:45 GMT

Hi @nnonm111,

You can use below to create similar output to your pyhton code.

Re: specific ip remove sql questio

nnonm111 — Wed, 14 Apr 2021 00:09:21 GMT

index="fw" src_ip="192.168.10.*"
| rex "192\.168\.10\.(?<range>\d{1,3})"
| where range >=11 AND range <=126
| dedup src_ip
| makeresults count=24
| streamstats count
| eval count=count+1
| eval count=count*5+1
| eval src_ip="192.168.10.".count
| stats values(src_ip) as src_ip
| nomv src_ip

You'll get that error.

Error in 'makeresults' command: This command must be the first command of a search.

Re: specific ip remove sql questio

scelikok — Wed, 14 Apr 2021 04:07:50 GMT

To use as a filter , you can use in a subsearch;