https://community.splunk.com/t5/Splunk-Search/When-searching-for-IP-how-to-only-show-the-subnet-not-the-whole/m-p/654512#M226135 <P>I have this search</P><PRE>index="firewall" dest_ip=172.99.99.99 dest_port=* | stats count by src_ip,dest_port,action,src_user</PRE><P>Instead of showing all src_ip's I want to group on the subnet part, that is using the dest_ip as an example, the three first (not being a network guy I might use the wrong wording <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> ) in the stats&nbsp;</P><PRE>172.99.99&nbsp;</PRE><P>My guess is rex, but guessing that there might be some other easier functions in Splunk for doing this?</P> Wed, 16 Aug 2023 15:16:11 GMT rune_hellem 2023-08-16T15:16:11Z https://community.splunk.com/t5/Splunk-Search/When-searching-for-IP-how-to-only-show-the-subnet-not-the-whole/m-p/654512#M226135 <P>I have this search</P><PRE>index="firewall" dest_ip=172.99.99.99 dest_port=* | stats count by src_ip,dest_port,action,src_user</PRE><P>Instead of showing all src_ip's I want to group on the subnet part, that is using the dest_ip as an example, the three first (not being a network guy I might use the wrong wording <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> ) in the stats&nbsp;</P><PRE>172.99.99&nbsp;</PRE><P>My guess is rex, but guessing that there might be some other easier functions in Splunk for doing this?</P> Wed, 16 Aug 2023 15:16:11 GMT https://community.splunk.com/t5/Splunk-Search/When-searching-for-IP-how-to-only-show-the-subnet-not-the-whole/m-p/654512#M226135 rune_hellem 2023-08-16T15:16:11Z https://community.splunk.com/t5/Splunk-Search/When-searching-for-IP-how-to-only-show-the-subnet-not-the-whole/m-p/654519#M226137 <P>If you know your subnet is 24 bits i.e. the first 3 numbers of an IPv4 address x.x.x.y, you could do this</P><LI-CODE lang="markup">index="firewall" dest_ip=172.99.99.99 dest_port=* | rex field=dest_ip "(?&lt;dest_ip_subnet&gt;^.*)\.\d+$" | stats count by src_ip,dest_port,dest_ip_subnet,action,src_user</LI-CODE> Wed, 16 Aug 2023 15:58:19 GMT https://community.splunk.com/t5/Splunk-Search/When-searching-for-IP-how-to-only-show-the-subnet-not-the-whole/m-p/654519#M226137 ITWhisperer 2023-08-16T15:58:19Z