Splunk Search

How to calculate subnet from list of IP addresses?

New Member

I'm trying to come up with a way to output to a lookup file a list of calculated network addresses given a list of IP addresses. By using a destination MAC address and a source IP, I'm able to group together a list of IPs that are using the same gateway with the following:

`index=zeek sourcetype=zeek_conn
| stats values(src) by resp_l2_addr`

But from here, I need to take those src values and have Splunk give me the smallest subnet that covers that range of addresses. For example, if I have and in the same list, I would need the query to say, based on these two addresses, there is a network.

I feel this is more of a machine learning type of problem, but wanted to see if anyone has come up with something similar that could solve this. Thanks!

Labels (3)
0 Karma


I am guessing that the machine learning remark is sarcasm, but a straight-face answer is no.  Machine learning deals with probabilistic computation, whereas this one is deterministic.  The challenge is that SPL may not be the best tool to perform this type of calculation.  But (most) any mathematical computation can be achieved if your only choice is SPL. (SPL does provide a couple convenience functions/commands.)

The following is an example of a labored "solution".  A small consideration is given in case the number of raw events is huge.

index=zeek sourcetype=zeek_conn
| stats values(src) as src by resp_l2_addr
| mvexpand src ``` in order to take advantage of SPL's IP sort ```
| sort ip(src)
| stats list(src) as src by resp_l2_addr ``` src is sorted in IP order ```
| eval minip = mvindex(src, 0), maxip = mvindex(src, -1)
| eval mask = mvrange(1, 33) ``` do not consider 0 ```
| eval match = mvmap(mask, if(cidrmatch(minip . "/" . mask, minip) AND cidrmatch(minip . "/" . mask, maxip), "yes", null()))
| eval minsubnet = minip . "/" . mvcount(match)

Note, the resultant minsubnet from your example will be based on minip, not on an arbitrarily determined network address such as  This sort of violates IPv4's routing protocol.  But I suspect that you are just seeking a convenient notation rather than seeking to configure routing with this calculation.  If you want to have a conformant representation, you can subtract 1 from minip and add 1 to maxip.

Otherwise, you can arbitrarily force 0 onto the least significant octet of minip, and arbitrarily force 255 onto maxip.  The possibilities are endless yet any choice is arbitrary.

Here is an emulation using the sample data you provided.  You can play with it and compare with your real data

| makeresults
| fields - _time
| eval src=mvappend("", "", "")
``` data emulation above ```
Tags (3)
0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...