I'd like to set the 192.x.x.x band ip for 7 days.
index="*" earliest=-7d| rex "192\.(?<range>\d{1,3})\.(?<range>\d{1,3})\.(?<range>\d{1,3})"
| where range >=xx AND range<=xx
How should I correct it?
| rex "(?<range>192(\.\d{1,3}){3})"
View solution in original post