topic Re: Why is the CIDR search on accelerated data failing? in Splunk Search

Why is the CIDR search on accelerated data failing?

isabel_ycourbe — Mon, 12 Feb 2018 14:32:26 GMT

When I run my tstat including a CIDR filter with summariesonly=T I got no result, while setting the parameter to false will give me my results:

Fails: | tstats summariesonly=T count from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest=10.0.0.0/8 by All_Traffic.dest
Works: | tstats summariesonly=F count from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest=10.0.0.0/8 by All_Traffic.dest but it's obviously slow
Works: | tstats summariesonly=T count from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest=10.* by All_Traffic.dest where I'm using wildcard instead of CIDR. NB: Datamodel is accelerated at 100% NB2: I testing even with large time range, result is the same

harsmarvania57 — Tue, 13 Feb 2018 08:24:51 GMT

As far as I know CIDR isn't supported in tstats commands with accelerated datamodel. Check this answer as well https://answers.splunk.com/answers/468781/how-do-i-do-a-cidr-matchnot-match-in-a-tstats-sear.html

isabel_ycourbe — Tue, 13 Feb 2018 08:54:14 GMT

Thanks for the answer and the workaround !

woodcock — Tue, 25 Jun 2019 17:38:48 GMT

Actually, natural CIDR filters work in tstats.

Like this:

| tstats count FROM datamodel=Network_Traffic WHERE index=* AND All_Traffic.src="10.0.0.0/8"

And this:

| tstats count WHERE index=* AND host="10.0.0.0/8"

This has been in Splunk for a long time, but maybe not always. It works in all versions of 7.*

abpe — Tue, 12 May 2020 09:25:29 GMT

For me CIDR filters on Splunk 7.3.3 fail. For example the query below should list only destinations which are IP's:

| tstats values(Web.dest) as dest from datamodel=Web where Web.dest="0.0.0.0/0"

However it just lists all kind of values.