Splunk Search

Conditional search for multiple IP ranges

vmorita
New Member

Hello there!

We´re trying to plan the best way to search multiple IP ranges that possibly can going through squid to Internet.

Nowadays in our enviroment we have specific IP range that can´t have access to internet. Therefore we decided to monitor this IP range creating specific alert.

I have researched in splunk answers and then I made the regex bellow but it didn´t work as I expected. The IP range that I want to take is 10.(1-200).(80-199).(231-254)

process="squid" httpstatus=200 | rex field=clientaddress "10.(?\d+).(?\d+).(?\d+)" | search (secoctect <200) N (79 > thiroctect <200) AND (four_octect >230)

Does anybody know what should I do? Any help I will appreciate it.

Thanks

0 Karma

rahulroy_splunk
Path Finder

Something like this should work for you.

process="squid" httpstatus=200 | regex clientaddress="10\.([1-9]|[1-9][0-9]|1[0-9][0-9]|200)\.([8-9][0-9]|1[0-9][0-9])\.(2(3[1-9]|4[0-9]|5[0-4]))" 

The regex command will match the specified regular expression for the field clientaddress and filter out non-matching events.

somesoni2
Revered Legend

Try like this

process="squid" httpstatus=200 | rex field=clientaddress "10\.(?<secoctect>\d+)\.(?<thiroctect>\d+)\.(?<four_octect>\d+)" | search (secoctect <200) AND (79 > thiroctect <200) AND (four_octect >230)

somesoni2
Revered Legend

My bad, missed backslashes with d. Try the updated answer...

0 Karma

vmorita
New Member

I tried like this

process="squid" httpstatus=200 | rex field=clientaddress "10.(?d+).(?d+).(?d+)" | search (sec_octect<200) AND (thir_octect > 79 AND thir_octect < 200) AND (four_octect >230)

But it did not work yet.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...