Getting Data In

Exclude CIDR range from search results

shiftey
Path Finder

Hi Splunk Answers,

I want to exclude IP addresses from certain networks in search results. The range is 10.52.0.0/24 - 10.52.40.0/24.

If I want to exclude using one range I would use

| where NOT cidrmatch("10.52.0.0/24")

How would I exclude multiple ranges?

Tags (3)
0 Karma

landen99
Motivator

1) Create a lookup table of cidr blocks
2) Create a lookup definition with the CIDR advanced option for matching
3) Use the lookup command and NOT out_field=*

index=... | lookup my_def in_field OUTPUT out_field | search NOT out_field=*
0 Karma

ptate
New Member

What if I wanted to use a lookup table for this? I have a lookup table of just a list of CIDR blocks and I want to exclude them when searching.

0 Karma

morethanyell
Builder

Check this app I created.

on Bitbucket: https://bitbucket.org/intalock/incidr/src/master/
on Github : https://github.com/morethanyell/incidr

This is an app I created that accepts multiple cidr blocks

0 Karma

stephanefotso
Motivator

Here you go:

  ... |where (NOT cidrmatch("10.52.0.0/24",ipfield) AND NOT cidrmatch("10.52.40.0/24",ipfield))|table ipfield

Thanks

SGF
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...