Splunk Search

CIDR lookup with normal lookup- Can I add single IP's to the same lookup file/definition?

izzie123
Path Finder

Hello,

I have created a lookup definition for CIDR. The CIDR matching works just fine and I am able to whitelist the IPs in that particular subnet range.

However, I wanted to know if I can add single IP's to the same lookup file/definition(CIDR lookup) as well?

I want single IP matching in the same lookup table where I have added the IP subnet.

How to proceed about this?

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Add single IPs to the lookup as 

n.n.n.n/32

i.e. a CIDR range of 1

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Add single IPs to the lookup as 

n.n.n.n/32

i.e. a CIDR range of 1

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...