https://community.splunk.com/t5/Splunk-Search/query-optimization-on-IP-adress/m-p/633877#M220154 <P><SPAN>Hello community!</SPAN></P><P>I'm looking for a way to optimize this search below and I need some help :</P><P>&nbsp;</P><LI-CODE lang="markup">index="oswinsec" source="XmlWinEventLog:Security" TargetUserName Kerberos earliest=-5min | regex TargetUserName="^([a-z]+)\.([a-z]+)" | regex IpAddress="\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}" | eval Octet1=mvindex(split(IpAddress,"."), 0) | eval Octet2=mvindex(split(IpAddress,"."), 1) | eval Octet3=mvindex(split(IpAddress,"."), 2) | where (Octet1=10 AND Octet2=244 AND Octet3&gt;=192 AND Octet3&lt;=255) OR (Octet1=172 AND Octet2=24) | dedup TargetUserName | table TargetUserName IpAddress</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>Thanking you!!</P><P>regards</P> Thu, 09 Mar 2023 13:17:51 GMT Nico99 2023-03-09T13:17:51Z https://community.splunk.com/t5/Splunk-Search/query-optimization-on-IP-adress/m-p/633877#M220154 <P><SPAN>Hello community!</SPAN></P><P>I'm looking for a way to optimize this search below and I need some help :</P><P>&nbsp;</P><LI-CODE lang="markup">index="oswinsec" source="XmlWinEventLog:Security" TargetUserName Kerberos earliest=-5min | regex TargetUserName="^([a-z]+)\.([a-z]+)" | regex IpAddress="\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}" | eval Octet1=mvindex(split(IpAddress,"."), 0) | eval Octet2=mvindex(split(IpAddress,"."), 1) | eval Octet3=mvindex(split(IpAddress,"."), 2) | where (Octet1=10 AND Octet2=244 AND Octet3&gt;=192 AND Octet3&lt;=255) OR (Octet1=172 AND Octet2=24) | dedup TargetUserName | table TargetUserName IpAddress</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>Thanking you!!</P><P>regards</P> Thu, 09 Mar 2023 13:17:51 GMT https://community.splunk.com/t5/Splunk-Search/query-optimization-on-IP-adress/m-p/633877#M220154 Nico99 2023-03-09T13:17:51Z https://community.splunk.com/t5/Splunk-Search/query-optimization-on-IP-adress/m-p/633882#M220156 <P>What is it you wish to optimize?</P><P>Have you looked at the <FONT face="courier new,courier">cidrmatch</FONT> function?</P> Thu, 09 Mar 2023 13:52:05 GMT https://community.splunk.com/t5/Splunk-Search/query-optimization-on-IP-adress/m-p/633882#M220156 richgalloway 2023-03-09T13:52:05Z https://community.splunk.com/t5/Splunk-Search/query-optimization-on-IP-adress/m-p/633920#M220168 <P>No i hadn't seen this function.<BR />We tried and it's indeed simpler.</P><P>Thank you so much!!</P> Thu, 09 Mar 2023 16:42:53 GMT https://community.splunk.com/t5/Splunk-Search/query-optimization-on-IP-adress/m-p/633920#M220168 Nico99 2023-03-09T16:42:53Z