https://community.splunk.com/t5/Splunk-Search/lookup-file-with-a-mix-of-ranges-of-IP-and-unique-IP/m-p/482101#M135075 <P>You need all addresses in your lookup to be in CIDR notation, that means your lookup should look like this.</P> <PRE><CODE>ip,entity 10.0.1.0/24,A 10.0.2.0/24,B 12.0.0.4/32,C 12.0.0.8/32,C </CODE></PRE> Wed, 04 Mar 2020 13:59:29 GMT nickhills 2020-03-04T13:59:29Z https://community.splunk.com/t5/Splunk-Search/lookup-file-with-a-mix-of-ranges-of-IP-and-unique-IP/m-p/482100#M135074 <P>Hi all</P> <P>I use a lookup file with a mix of ranges of IP and unique IP to count events of login</P> <P>My file is like this</P> <P>ip,entity<BR /> 10.0.1.0/24, A<BR /> 10.0.2.0/24, B<BR /> 12.0.0.4,C<BR /> 12.0.0.8,C</P> <P>I configure my lookup file with CIDR option but the result of search only extract the<BR /> events of ip integrated in ranges of ip.</P> <P>I woulld like to extract all the results</P> <P>how can I solved this with only one lookup file ?</P> Wed, 04 Mar 2020 09:35:08 GMT https://community.splunk.com/t5/Splunk-Search/lookup-file-with-a-mix-of-ranges-of-IP-and-unique-IP/m-p/482100#M135074 faribole 2020-03-04T09:35:08Z https://community.splunk.com/t5/Splunk-Search/lookup-file-with-a-mix-of-ranges-of-IP-and-unique-IP/m-p/482101#M135075 <P>You need all addresses in your lookup to be in CIDR notation, that means your lookup should look like this.</P> <PRE><CODE>ip,entity 10.0.1.0/24,A 10.0.2.0/24,B 12.0.0.4/32,C 12.0.0.8/32,C </CODE></PRE> Wed, 04 Mar 2020 13:59:29 GMT https://community.splunk.com/t5/Splunk-Search/lookup-file-with-a-mix-of-ranges-of-IP-and-unique-IP/m-p/482101#M135075 nickhills 2020-03-04T13:59:29Z