topic Re: splunk syntax search a subnet in Splunk Search

splunk syntax search a subnet

trojan_81 — Thu, 19 Dec 2019 20:11:55 GMT

All,

I want search a subnet over all indexes and sourcetypes. The subnet is 5.5.0.0/16
How would the query look so I can identify any IP within the 5.5.0.0/16 subnet?

thanks in advance

Re: splunk syntax search a subnet

to4kawa — Fri, 20 Dec 2019 14:05:29 GMT

index=your_index sourcetype=your_sourcetype src="5.5.0.0/16" OR dst="5.5.0.0/16"

splunk can resolve prefix.

Re: splunk syntax search a subnet

tbavarva — Sat, 21 Dec 2019 08:43:22 GMT

Below query is written considering search for 5.5.0.0/16 subnet over any index and sourcetype and IP address is not extracted in particular field (src and dest).

index=* sourcetype=* "5.5.0.0/16"

If your events have extracted IP address in src and dest fields, you can go for the query what @to4kawa has mentioned in its post.

Regards,
Tejas

Re: splunk syntax search a subnet

to4kawa — Sat, 21 Dec 2019 08:50:32 GMT

TERM("5.5.0.0/16")

Is this possible?

Re: splunk syntax search a subnet

martynoconnor — Sat, 21 Dec 2019 11:34:18 GMT

I'm not sure about using TERM for subnets. TERM instructs Splunk to not view the dot as a minor breaker, but instead to literally search for that IP, not for 5 5 0 0.

Re: splunk syntax search a subnet

to4kawa — Sat, 21 Dec 2019 19:10:33 GMT

thanks, @martynoconnor
that's right.
Search failed.