Archive

define two fields for cidrmatch function

Communicator

I want to use the eval function with cidrmatch function like

1- who to mention multip subnets in x field against cidrmatch function.

| eval network-outbound=if(cidrmatch("10...*/8",src), "local", "public")

0 Karma
1 Solution

SplunkTrust
SplunkTrust

@rashid47010,

Does this work for you ?

| eval network-outbound=if( cidrmatch("10.1.1.0/8",src) OR cidrmatch("10.10.10.0/8",src) OR ..., "local", "public")

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@rashid47010,

Does this work for you ?

| eval network-outbound=if( cidrmatch("10.1.1.0/8",src) OR cidrmatch("10.10.10.0/8",src) OR ..., "local", "public")

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!