Splunk Search

CIDR lookup with normal lookup- Can I add single IP's to the same lookup file/definition?

izzie123
Path Finder

Hello,

I have created a lookup definition for CIDR. The CIDR matching works just fine and I am able to whitelist the IPs in that particular subnet range.

However, I wanted to know if I can add single IP's to the same lookup file/definition(CIDR lookup) as well?

I want single IP matching in the same lookup table where I have added the IP subnet.

How to proceed about this?

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Add single IPs to the lookup as 

n.n.n.n/32

i.e. a CIDR range of 1

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Add single IPs to the lookup as 

n.n.n.n/32

i.e. a CIDR range of 1

Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...