Filter IPs not in ranges

[karimoss]

Hello,

I have a list of IPs generated from the following search :

index=<source>| stats count by ip

and I want to identify IPs that do not belong to any of the IP address ranges in my results. Example :

a.b.c.101

a.b.c.102

a.b.c.103

d.e.f.g

a.b.c.104

I want to keep only the address d.e.f.g

Thank in advance for your help

Regards,

[yuanliu]

As @VatsalJagani said, you need to talk to someone who understands IPv4 address space to help you formulating what you call "IP address ranges" into mathematical formula(e) that a computer can easily understand.  Maybe a network engineer in your organization. (You don't want to give your internal IP ranges to a public forum like this.)  These days, CIDR is the most common way of expressing IPv4 address ranges, and Splunk supports it right in the search command.  See CIDR matching.  Once you know your CIDR, you can do something like

index = <source> ip != <CIDR1> ip != <CIDR2>, ...
| stats count by ip

To give you an example using the same data as given in the document, you want to exclude 10.10.10.1 through 10.10.10.255, and your data contains these

_time	ip
2023-09-23 16:08:12	10.10.10.12
2023-09-23 16:08:12	50.10.10.17
2023-09-23 16:08:12	10.10.10.23

You run

index = <source> ip != 10.10.10.0/24
| stats count by ip

The result is

ip	count
50.10.10.17	1

You can try this with the following emulation

| makeresults
| eval ip = split("10.10.10.12
50.10.10.17
10.10.10.23", "
")
| mvexpand ip
``` the above emulates raw data ```
| search ip!=10.10.10.0/24
| stats count by ip

If you can't find suitable people to ask for help, there are also CIDR calculators online.  Just be careful with your proprietary data.

[VatsalJagani]

---

and I want to identify IPs that do not belong to any of the IP address ranges in my results. Example :

---

@karimoss - Do you want to print out all the possible IP addresses that are not in your result?

* How is d.e.f.g IP different from other IPs in the result set? Is it the only IP with a different subnet?

* Are you looking to find subnet vise?

[PickleRick]

Also remember that by filtering early you make search more efficient.