Splunk Search

How To Filter IP Field Using Subnet Value Stored In Variable




I am trying to create a drill down dashboard. Basically I want to pass a subnet value (which is currently represented as a string) from one pane to another search pane and search on data in that query using the subnet value. I have tried several methods and none seem to work.


Ideally I thought something like the below would work in pseudo code.


Search ... |
eval subnet_value=$subnet value from first query$ |
where ipv4=subnet_value 


However, I get back no results. Perhaps someone has some tips on some things I can try next as I am stuck currently.


Thanks in advance,


Labels (2)
0 Karma


how are you passing your subnet value?

can you share example subnet value?

you can't compare ipv4 with subnet (for example as you mentioned in your pseudo code 

where ipv4=subnet_value

instead, you get value to current search from other dashboard ( I believe your subnet value coming from dashboard would be something like ). you can write this value to lookup using outputlookup command from current search. define lookup where lookup can match cidr for specified field.

and then you have to use lookup command instead of where like above.

If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...