topic IPv6 subnets and splunk searchs in Splunk Search

IPv6 subnets and splunk searchs

g_prez — Thu, 03 Feb 2011 03:00:18 GMT

Splunk today is IPv4 subnet aware so that if you do a search with something like ip_address = 10.0.0.0/24 .. splunk knows to look for items 10.0.0.0 thru 10.0.0.255 ... NICE ! Now what about IPV6 ... I think the answer is No. my question is when or how can this be done

example IPv6_ADDR = 2001:54FF::/48 would look for a whole lot of stuff but something like 2001:54FF:: to 2001:54FF:0000:FFFF:FFFF

And this gets instresting as you can show the first part of the IPV6 address as 2001:54FF:0000:0000 or 2001:54ff:: or 2001:54ff:0000::

It depends on what the system sending the log spits out ...

Re: IPv6 subnets and splunk searchs

g_prez — Thu, 03 Feb 2011 08:22:15 GMT

opps was a bit off this FFFF:FFFF in the that post that address should be 2001:54FF:0000:ffff:ffff:ffff:ffff:ffff
got tired of typing ffff I guess.

Re: IPv6 subnets and splunk searchs

bshuler_splunk — Thu, 16 Apr 2015 10:59:57 GMT

This search shows the problem.

Splunk currently does not support ipv6 CIDR searching.

BUT, because you are searching for a /48, these both work:

As you can see, the capitalization does not matter.