topic Re: Is it possible to do a CIDR match in a tstats where clause? in Splunk Search

Is it possible to do a CIDR match in a tstats where clause?

IgorB — Mon, 11 Jul 2016 22:25:11 GMT

Is it possible to match IP address range in tstats where clause?

Example:
It's possible to do this with search+stats:

index=test IP="10.1.1.0/25" | stats count by IP

But since we have IP extracted at index time, I'd rather take advantage of tstats performance and run something like

| tstats count where index=test IP="10.1.1.0/25" by IP

but that doesn't work as expected - tstats matches any IP as if the filter was IP="*"
Ideas?

Re: Is it possible to do a CIDR match in a tstats where clause?

gcusello — Tue, 12 Jul 2016 07:02:37 GMT

I think that you already used the tscollect (eg.g. in test_stats) command before use tstats, something like this

   index=test earliest=-30d latest=now | table _time IP field1 field2 field3 ... | tscollect test_stats

so the command could be:

  | tstats count FROM tests_stats GROUPBY IP

Bye.
Giuseppe

Re: Is it possible to do a CIDR match in a tstats where clause?

gcusello — Fri, 09 Sep 2016 11:06:50 GMT

if you're satisfied of the answer, please, accept the answer.
Bye.
Giuseppe

Re: Is it possible to do a CIDR match in a tstats where clause?

IgorB — Mon, 12 Sep 2016 14:48:35 GMT

I downvoted this post because:
Sorry, can't accept. your reply doesn't answer my question:
1. your assumption that I've used '| tscollect' is incorrect
2. '| tstats ... ' you proposed misses the point of returning only ips in a specific range

Re: Is it possible to do a CIDR match in a tstats where clause?

dshpritz — Wed, 21 Dec 2016 15:45:24 GMT

tstats is not CIDR aware for where clauses. Sorry 😞

Re: Is it possible to do a CIDR match in a tstats where clause?

woodcock — Tue, 25 Jun 2019 17:39:15 GMT

Actually, natural CIDR filters work in tstats.

Like this:

| tstats count FROM datamodel=Network_Traffic WHERE index=* AND All_Traffic.src="10.0.0.0/8"

And this:

| tstats count WHERE index=* AND host="10.0.0.0/8"

This has been in Splunk for a long time, but maybe not always. It works in all versions of 7.*

Re: Is it possible to do a CIDR match in a tstats where clause?

IgorB — Tue, 25 Jun 2019 19:17:02 GMT

Apparently this is no longer true in Splunk v.7.x.
Thanks to @woodcock for pointing this out

Re: Is it possible to do a CIDR match in a tstats where clause?

astatrial — Thu, 03 Sep 2020 08:28:58 GMT

Is the negative form suppose to work as well?

For example:

| tstats count FROM datamodel=Network_Traffic WHERE index=* AND All_Traffic.src!="10.0.0.0/8"