Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How do I match an IP address to a range that s...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am trying to match IP addresses in the block of addresses - 10.120.1.0 through 10.120.13.255. This range spans several CIDR ranges
10.120.1.0/24 + 10.120.2.0/23 + 10.120.4.0/22 + 10.120.8.0/22 + 10.122.12.0/23. Is there a way to search not using eval cidrmatch?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could use a regex command to check if the ip matches the pattern and filter for these events
| regex ip="10.120.(?:[1-9]|1[0-3]).[0-255]"
Alternatively, you can just use cidrmatch with the case command.
| eval match=case(
cidrmatch("10.120.1.0/24" ,ip) ,"1",
cidrmatch("10.120.2.0/23" ,ip) ,"1",
cidrmatch("10.120.4.0/22" ,ip) ,"1",
cidrmatch("10.120.8.0/22" ,ip) ,"1",
cidrmatch("10.120.12.0/23",ip),"1",
1=1,"0")
HTH,
Raschko
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could use a regex command to check if the ip matches the pattern and filter for these events
| regex ip="10.120.(?:[1-9]|1[0-3]).[0-255]"
Alternatively, you can just use cidrmatch with the case command.
| eval match=case(
cidrmatch("10.120.1.0/24" ,ip) ,"1",
cidrmatch("10.120.2.0/23" ,ip) ,"1",
cidrmatch("10.120.4.0/22" ,ip) ,"1",
cidrmatch("10.120.8.0/22" ,ip) ,"1",
cidrmatch("10.120.12.0/23",ip),"1",
1=1,"0")
HTH,
Raschko
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @Raschko wht this section of code 1=1,"0" on eval doing . Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The eval answer is just exactly what I needed. I need to have several other sub-nets defined and this lets me expand to cover all of them.
Thanks for the help!!
Scott
Splunk Observability for AI
Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...
Splunk Observability as Code: From Zero to Dashboard
