topic Re: How to search IP with wildcard? in Splunk Search

How to search IP with wildcard?

mveca — Fri, 31 May 2019 15:46:33 GMT

I want to exclude both primary and secondary IP addresses from a search.

For example:

src_ip!=192.50.244.10 AND src_ip!=192.50.245.10

Can I combine the two by just using a wildcard in just one octet?

For example, something like:

src_ip!=192.50.24*.10

Re: How to search IP with wildcard?

DavidHourani — Fri, 31 May 2019 16:56:21 GMT

Hi @mveca,

You could use a wildcard but that will match more than what you require since that also includes : 192.50.241.10,192.50.242.10 and others that you might want to keep.

If you really want to use a regex you could try something like what is shown here :
https://answers.splunk.com/answers/97697/exclude-regex-results-from-a-search.html

Your search would look like this :

yourbasesearch | regex src_ip!="192.50.24[4,5].10"

Let me know if that helps.

Cheers,
David

Re: How to search IP with wildcard?

VatsalJagani — Tue, 04 Jun 2019 06:50:26 GMT

@mveca - Yes you can do src_ip!=192.50.24*.10.

Re: How to search IP with wildcard?

DavidHourani — Tue, 04 Jun 2019 07:14:15 GMT

this excludes 192.50.240.10,192.50.241.10....192.50.249.10 not just the primary IPs.

Re: How to search IP with wildcard?

VatsalJagani — Tue, 04 Jun 2019 08:53:24 GMT

I think that's what @mveca wants, "not condition with wildcard".