https://community.splunk.com/t5/Splunk-Search/Can-search-sytax-use-the-notation-of-network-mask-like-24/m-p/72500#M18130 <P>You can also use <CODE>cidrmatch</CODE> in the eval command. If you are dealing with known (usually internal) subnets, you can also resolve them by name - see this thread: <A href="http://answers.splunk.com/questions/5916/using-cidr-in-a-lookup-table">http://answers.splunk.com/questions/5916/using-cidr-in-a-lookup-table</A></P> Tue, 19 Oct 2010 11:42:04 GMT southeringtonp 2010-10-19T11:42:04Z https://community.splunk.com/t5/Splunk-Search/Can-search-sytax-use-the-notation-of-network-mask-like-24/m-p/72498#M18128 <P>Dear all, i wanna filter the specific ip range for one country, can search sytax use the notation of network mask like /24, for instance, the ip range from 110.77.0.0 to 110.77.127.255, i hope i can use 110.77.0/17 rather than 110.77.0.<EM>~110.77.127.</EM> as filter condition. Any other better suggestions?Thanks</P> Tue, 19 Oct 2010 11:00:42 GMT https://community.splunk.com/t5/Splunk-Search/Can-search-sytax-use-the-notation-of-network-mask-like-24/m-p/72498#M18128 hjwang 2010-10-19T11:00:42Z https://community.splunk.com/t5/Splunk-Search/Can-search-sytax-use-the-notation-of-network-mask-like-24/m-p/72499#M18129 <P>Yes, you can, but only as a field value match, i.e., you can search for <CODE>ipaddr=110.77.0.0/23</CODE> but not for just <CODE>110.77.0.0/23</CODE>.</P> Tue, 19 Oct 2010 11:39:42 GMT https://community.splunk.com/t5/Splunk-Search/Can-search-sytax-use-the-notation-of-network-mask-like-24/m-p/72499#M18129 gkanapathy 2010-10-19T11:39:42Z https://community.splunk.com/t5/Splunk-Search/Can-search-sytax-use-the-notation-of-network-mask-like-24/m-p/72500#M18130 <P>You can also use <CODE>cidrmatch</CODE> in the eval command. If you are dealing with known (usually internal) subnets, you can also resolve them by name - see this thread: <A href="http://answers.splunk.com/questions/5916/using-cidr-in-a-lookup-table">http://answers.splunk.com/questions/5916/using-cidr-in-a-lookup-table</A></P> Tue, 19 Oct 2010 11:42:04 GMT https://community.splunk.com/t5/Splunk-Search/Can-search-sytax-use-the-notation-of-network-mask-like-24/m-p/72500#M18130 southeringtonp 2010-10-19T11:42:04Z https://community.splunk.com/t5/Splunk-Search/Can-search-sytax-use-the-notation-of-network-mask-like-24/m-p/72501#M18131 <P>You rock Gerald!</P> Fri, 05 Nov 2010 05:01:25 GMT https://community.splunk.com/t5/Splunk-Search/Can-search-sytax-use-the-notation-of-network-mask-like-24/m-p/72501#M18131 sdwilkerson 2010-11-05T05:01:25Z https://community.splunk.com/t5/Splunk-Search/Can-search-sytax-use-the-notation-of-network-mask-like-24/m-p/72502#M18132 <P>@southeringtonp -- Thank you for posting the cross-reference. That second question is exactly what I needed.</P> Sun, 25 Aug 2013 01:20:19 GMT https://community.splunk.com/t5/Splunk-Search/Can-search-sytax-use-the-notation-of-network-mask-like-24/m-p/72502#M18132 usethedata 2013-08-25T01:20:19Z