How to exclude IP range for set of groups?

[kpavan]

Hi All,

I have dashboard displaying list of groups asset counts for various business units and recently has some one requested some set of ip ranges need to be excluded. But problem is if am using eg NOT (IP="10.0.0.0/8") in my base search this is affecting other group asset count for all other BU as overlap of same subnet range.

How can i create search query to make this exclusion for specific group/BU wise, instead of applying for all group/BU.

my current search looks something like this,

index=something sourcetype=anything (ip="10.0.0.0/8" OR ip="192.168.0.0/16" OR ip="172.16.0.0/12") | eval bu=(network="network_name1", "bu1", network="network_name2", "bu2",network="network_name3", "bu3",network="network_name4", "bu4")| stats dc(ip) by bu

Thanks!

[ITWhisperer · Accepted solution]

Do you mean something like this?

index=something sourcetype=anything network!="network_name1" OR NOT (ip="10.0.0.0/8" OR ip="192.168.0.0/16" OR ip="172.16.0.0/12")

[kpavan]

thanks for the reply! Actually am looking for query which should only exclude for where is needed, your query will work only if no other BU using same subnet/network range, since most of the network ranges are overlap with other BU if i exclude in base search it will exclude for other BU's which as same network.I was looking something if BU1 share exclude list this ip range should only change for BU1 itself if same range is present in BU2 should remain same without excluding.

Thanks!

[ITWhisperer]

I think that is what it is doing - essentially if the network isn't network 1 i.e. I assumed this would include all non BU1 networks whether they overlap with BU1 or not, OR if it is network 1 then the ip address mustn't be in one of the ranges mentioned. Is this not what you are asking for?