To use as a filter , you can use in a subsearch;
index="fw" src_ip="192.168.10.*"
| dedup src_ip
| search
[| makeresults count=24
| streamstats count
| eval count=count+1
| eval count=count*5+1
| eval src_ip="192.168.10.".count
| stats values(src_ip) as src_ip ]
To use as a filter , you can use in a subsearch;
index="fw" src_ip="192.168.10.*"
| dedup src_ip
| search
[| makeresults count=24
| streamstats count
| eval count=count+1
| eval count=count*5+1
| eval src_ip="192.168.10.".count
| stats values(src_ip) as src_ip ]
Hi @nnonm111,
You can use below to create similar output to your pyhton code.
| makeresults count=24
| streamstats count
| eval count=count+1
| eval count=count*5+1
| eval src_ip="192.168.10.".count
| stats values(src_ip) as src_ip
| nomv src_ip
index="fw" src_ip="192.168.10.*"
| rex "192\.168\.10\.(?<range>\d{1,3})"
| where range >=11 AND range <=126
| dedup src_ip
| makeresults count=24
| streamstats count
| eval count=count+1
| eval count=count*5+1
| eval src_ip="192.168.10.".count
| stats values(src_ip) as src_ip
| nomv src_ip
You'll get that error.
Error in 'makeresults' command: This command must be the first command of a search.
You can use regex to filter those ip addresses, please try below;
| regex src_ip!="192\.168\.10\.1[2-5]"
The sql does not fit.
index=fw
filed=src_ip
python code
a = '192.168.11.'
for i in range(11,127,5):
ip = str(a)+str(i)
print(ip)
Can the pyhton be expressed in sql?
Hi @nnonm111,
You question is not clear, could you please tell us what do you want to do with that four ip? (The list has actually five ips)
After 192.168.10.11 we would like to exclude 4 ip(192.168.10.12,13,14,15) by 192.168.10.126.
Output value:
192.168.10.11
192.168.10.16
192.168.10.21
.
.
.
192.168.10.126