Define IP subnet in ALARM FILTER

[null0]

Hello,
I need to make this search-filter

host=10.29.57.(128-255) AND "%ETHPORT-5-IF_*" OR "(Link failure)" OR "changed state to down"

working for emailed alerts forsyslog containig words betw " ".

my problem is how to correctly define the 10.29.57.128 /25 . i've tried with <=/>= and many conbinations but seems to be not working.

Could you help me pls?

[renjith_nair]

Try this answer,
https://answers.splunk.com/answers/470035/how-to-search-for-a-range-of-ip-addresses-example.html

host=10.29.57.* AND "%ETHPORT-5-IF_*" OR "(Link failure)" OR "changed state to down"|rex field=host  "10\.10\.10\.(?<range>\d{1,3})"
 | where range >=128 AND range<=255

[null0]

OK thanks to all

i edit this one as follow

     host=10.29.57.* AND "%ETHPORT-5-IF_*" OR "(Link failure)" OR "changed state to down"|rex field=host  "10\.29\.57\.(?<range>\d{1,3})"
      | where range >=128 AND range<=255

now i shold integrate this with other 2 subnets /24 (see below). i've tried to do something but is not so easy to fit them in previous query

(host=10.29.35.) and (host=10.29.25.) and 10.29.57.128/25 in a single query

[renjith_nair]

probably you can use a case here. Try this but you might need to adjust the match and regex

(host=10.29.57.* OR host=10.29.35.* OR host=10.29.25.*) AND "%ETHPORT-5-IF_*" OR "(Link failure)" OR "changed state to down"
|rex field=host  "10\.29\.57\.(?<range_25>\d{1,3})"
|rex field=host  "10\.29\.[2,3]5\.(?<range_24>\d{1,3})"
|eval found=case(match(host,10.29.57) AND (range_25 >=128 AND range<=255),"1",match(host,10.29.[2,3]5) AND (range_25 >=1 AND range<=255)."1",1==1,0)
|where found=1

[ansif]

Try this:

index=something "%ETHPORT-5-IF_*" OR "(Link failure)" OR "changed state to down"|where cidrmatch("10.29.57.128 /25",ipfieldname)