topic Re: Filter IPs not in ranges in Splunk Search

Filter IPs not in ranges

karimoss — Sat, 23 Sep 2023 12:22:29 GMT

Hello,

I have a list of IPs generated from the following search :

index=<source>| stats count by ip

and I want to identify IPs that do not belong to any of the IP address ranges in my results. Example :

a.b.c.101

a.b.c.102

a.b.c.103

d.e.f.g

a.b.c.104

I want to keep only the address d.e.f.g

Thank in advance for your help

Regards,

Re: Filter IPs not in ranges

VatsalJagani — Sat, 23 Sep 2023 13:15:46 GMT

and I want to identify IPs that do not belong to any of the IP address ranges in my results. Example :

@karimoss - Do you want to print out all the possible IP addresses that are not in your result?

* How is d.e.f.g IP different from other IPs in the result set? Is it the only IP with a different subnet?

* Are you looking to find subnet vise?

Re: Filter IPs not in ranges

PickleRick — Sat, 23 Sep 2023 18:39:09 GMT

Also remember that by filtering early you make search more efficient.

Re: Filter IPs not in ranges

yuanliu — Sat, 23 Sep 2023 23:16:43 GMT

As @VatsalJagani said, you need to talk to someone who understands IPv4 address space to help you formulating what you call "IP address ranges" into mathematical formula(e) that a computer can easily understand. Maybe a network engineer in your organization. (You don't want to give your internal IP ranges to a public forum like this.) These days, CIDR is the most common way of expressing IPv4 address ranges, and Splunk supports it right in the search command. See CIDR matching. Once you know your CIDR, you can do something like

index = <source> ip != <CIDR1> ip != <CIDR2>, ... | stats count by ip

To give you an example using the same data as given in the document, you want to exclude 10.10.10.1 through 10.10.10.255, and your data contains these

_time	ip
2023-09-23 16:08:12	10.10.10.12
2023-09-23 16:08:12	50.10.10.17
2023-09-23 16:08:12	10.10.10.23

You run

index = <source> ip != 10.10.10.0/24 | stats count by ip

The result is

ip	count
50.10.10.17	1

You can try this with the following emulation

If you can't find suitable people to ask for help, there are also CIDR calculators online. Just be careful with your proprietary data.