Splunk Search

Explorer

Hello everyone

I want to calculate the network address from an IP and a mask:

IP = 192.168.1.10

Desired result = 192.168.1.0

Unfortunately I can't find a function or method to do this.

I looked for the 'cidrmatch' function but it only seems to return a boolean. Is there another way?

Labels (1)
• ### other

1 Solution
SplunkTrust

If you are willing to accept some acrobat, ipmask can be used even with variable net masks.

| map search="| makeresults |fields - _*

Emulated data below should give

 IP Mask Network 192.168.1.10 255.255.255.0 192.168.1.0 10.54.3.8 255.255.246.0 10.54.2.0

Here is the emulation for you to play with and compare with real data

192.168.1.10, 255.255.255.0
10.54.3.8, 255.255.246.0"

But again, to say 192.168.1.0 is a network address is (very) classism.  The CIDR expressions should be

 IP Mask Network 192.168.1.10 255.255.255.0 192.168.1.0/24 10.54.3.8 255.255.248.0 10.54.0.0/21

N'est-ce pas?  This can be obtained with a bit of bit math, like this:

| map search="| makeresults |fields - _*

Tags (1)
SplunkTrust

If you are willing to accept some acrobat, ipmask can be used even with variable net masks.

| map search="| makeresults |fields - _*

Emulated data below should give

 IP Mask Network 192.168.1.10 255.255.255.0 192.168.1.0 10.54.3.8 255.255.246.0 10.54.2.0

Here is the emulation for you to play with and compare with real data

192.168.1.10, 255.255.255.0
10.54.3.8, 255.255.246.0"

But again, to say 192.168.1.0 is a network address is (very) classism.  The CIDR expressions should be

 IP Mask Network 192.168.1.10 255.255.255.0 192.168.1.0/24 10.54.3.8 255.255.248.0 10.54.0.0/21

N'est-ce pas?  This can be obtained with a bit of bit math, like this:

| map search="| makeresults |fields - _*

Tags (1)
Explorer

Good morning,

Thank you for the feedback.

Unfortunately the netmask is not fixed...

I'll try with the app
https://splunkbase.splunk.com/app/6595

Explorer

Hi yuanliu

Thank you for the feedback.

It's perfect! 🙂

SplunkTrust

Get Updates on the Splunk Community!

#### Cloud Platform | Customer Change Announcement: Email Notification Will Be Available ...

The Notification Team is migrating our email service provider since currently there’s no support ...

#### Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

#### Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...