topic Re: How to search for a range of IP addresses (example: 10.10.10.32 through 10.10.10.96)? in Splunk Search

How to search for a range of IP addresses (example: 10.10.10.32 through 10.10.10.96)?

kmulcahy — Wed, 02 Nov 2016 19:58:27 GMT

Does anyone know the criteria to search for a range of IP address under the following conditions.

I want to narrow the results down to IP addresses that fall within 10.10.10.32 - 10.10.10.96 or say 10.10.10.1 - 10.10.10.128.

I've used the regex _ip="10.10.10.(3[0-9])" and got successful results for addresses in 10.10.10.30-39. But how can I do what I'm asking above.

Any help is greatly appreciated.

Thanks

Re: How to search for a range of IP addresses (example: 10.10.10.32 through 10.10.10.96)?

LCM_BRogerson — Wed, 02 Nov 2016 20:38:35 GMT

CIDR notation might be what you're looking for

 _ip=10.10.10.32/27 OR _ip=10.10.10.64/27 OR _ip=10.10.10.96

would give you a range of 10.10.10.32-10.10.10.96. Or you expand the regex to something like

regex _ip="10.10.10.(3[2-9]|[4-8][0-9]|9[0-6])"

Re: How to search for a range of IP addresses (example: 10.10.10.32 through 10.10.10.96)?

gokadroid — Wed, 02 Nov 2016 21:01:14 GMT

If all you need is a range comparison on "10.10.10.xxx" what you could do is extract the range and compare on it as:

10.10.10.32 - 10.10.10.96

yourBaseQuery to give you ips
| rex "10\.10\.10\.(?<range>\d{1,3})"
| where range >=32 AND range<=96
| complete your Query

or similarly for 1-128

If you want more dynamic ips then that can be regexed too like below as long as you keep track of those range numbers

yourBaseQuery to give you ips
| rex "\d{1,3}\.\d{1,3}\.\d{1,3}\.(?<range>\d{1,3})"
| where range >=32 AND range<=96
| complete your Query

Re: How to search for a range of IP addresses (example: 10.10.10.32 through 10.10.10.96)?

aaraneta_splunk — Sat, 19 Nov 2016 00:25:55 GMT

@kmulcahy - Did any of the below answers help you out? If yes, please don't forget to click "Accept" below the best answer. If no, please leave a comment with some additional feedback. Thanks!

Re: How to search for a range of IP addresses (example: 10.10.10.32 through 10.10.10.96)?

logloganathan — Fri, 02 Mar 2018 13:38:11 GMT

your query | rex field=_raw "10.10.10.(?\d{1,3})" | where range >=32 AND range<=96

for the IP range 10.10.10.32 - 10.10.10.96

your query | rex field=_raw "10.10.10.(?\d{1,3})" | where range >=1 AND range<=128

for the IP range 10.10.10.1 - 10.10.10.128

Re: How to search for a range of IP addresses (example: 10.10.10.32 through 10.10.10.96)?

logloganathan — Fri, 02 Mar 2018 13:38:57 GMT

I downvoted this post because not properly explained

Re: How to search for a range of IP addresses (example: 10.10.10.32 through 10.10.10.96)?

ppablo — Fri, 02 Mar 2018 15:55:23 GMT

Hi @logloganathan

Downvoting should only be reserved for suggestions/solutions that could be potentially harmful for a Splunk environment or goes completely against known best practices. Simply commenting with constructive feedback on the post you are concerned with will be more beneficial for the community to learn from.

Some of the most active members in Answers have helped set the standard of how voting etiquette should work in the Splunk community which distinguishes our culture apart from other Q&A forums. Upvote early and often to give credit where it’s due for high quality posts, comment where you think feedback needs to be given, and only downvote if something potentially dangerous is suggested or people are just being inappropriate.

If you’re interested in seeing how this voting etiquette was developed, check out this Splunk Answers post: https://answers.splunk.com/answers/244111/proper-etiquette-and-timing-for-voting-here-on-ans.html

Re: How to search for a range of IP addresses (example: 10.10.10.32 through 10.10.10.96)?

DalJeanis — Fri, 02 Mar 2018 16:29:31 GMT

@LCM_BRogerson, @kmulcahy -

That regex would also match "10X10Q10!39". The periods need to be escaped, or they will match any character.

 | regex _ip="10\.10\.10\.(3[2-9]|[4-8][0-9]|9[0-6])"