topic Re: IP Address in Splunk Search

IP Address

rahmania — Tue, 29 Sep 2020 07:39:51 GMT

Hi,

I want to find the IP address : 10.1.4.0 to 10.1.41.128 on Splunk Search.
Is there an efficient query than OR ? (index=sources_Ip (sources_ip="10.1.4.0" OR sources_ip="10.1.4.1" OR sources_ip="1.1.4.2" OR ...) )

Thanks

S.V

Re: IP Address

richgalloway — Fri, 23 Oct 2015 12:19:12 GMT

You could use wildcards to simplify the query.

index=sources_Ip sources_ip="10.1.*"

Or perhaps you can use CIDRs.

index=sources_Ip | where (cidrmatch("10.1.4.0/24", sources_ip) OR cidrmatch("10.1.5.0/24", sources_ip) ...) | ...

Re: IP Address

David — Fri, 23 Oct 2015 15:20:15 GMT

Just a note -- you can also run CIDR matches in the base search. E.g., index=sources_Ip sources_ip=10.1.4.0/24 OR sources_ip=10.1.5.0/24.