Splunk Search

CIDR lookup with normal lookup- Can I add single IP's to the same lookup file/definition?

izzie123
Path Finder

Hello,

I have created a lookup definition for CIDR. The CIDR matching works just fine and I am able to whitelist the IPs in that particular subnet range.

However, I wanted to know if I can add single IP's to the same lookup file/definition(CIDR lookup) as well?

I want single IP matching in the same lookup table where I have added the IP subnet.

How to proceed about this?

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Add single IPs to the lookup as 

n.n.n.n/32

i.e. a CIDR range of 1

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Add single IPs to the lookup as 

n.n.n.n/32

i.e. a CIDR range of 1

Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...