Splunk Search

How to exclude IP range for set of groups?

kpavan
Path Finder

Hi All,

I have dashboard displaying list of groups asset counts for various business units and recently has some one requested some set of ip ranges need to be excluded. But problem is if am using eg NOT (IP="10.0.0.0/8") in my base search this is affecting other group asset count for all other BU as overlap of same subnet range.

How can i create search query to make this exclusion for specific group/BU wise, instead of applying for all group/BU.

my current search looks something like this,

index=something sourcetype=anything (ip="10.0.0.0/8" OR ip="192.168.0.0/16" OR ip="172.16.0.0/12") | eval bu=(network="network_name1", "bu1", network="network_name2", "bu2",network="network_name3", "bu3",network="network_name4", "bu4")| stats dc(ip) by bu

Thanks!

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean something like this?

index=something sourcetype=anything network!="network_name1" OR NOT (ip="10.0.0.0/8" OR ip="192.168.0.0/16" OR ip="172.16.0.0/12")

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean something like this?

index=something sourcetype=anything network!="network_name1" OR NOT (ip="10.0.0.0/8" OR ip="192.168.0.0/16" OR ip="172.16.0.0/12")
0 Karma

kpavan
Path Finder

thanks for the reply! Actually am looking for query which should only exclude for where is needed, your query will work only if no other BU using same subnet/network range, since most of the network ranges are overlap with other BU if i exclude in base search it will exclude for other BU's which as same network.I was looking something if BU1 share exclude list this ip range should only change for BU1 itself if same range is present in BU2 should remain same without excluding.

Thanks!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I think that is what it is doing - essentially if the network isn't network 1 i.e. I assumed this would include all non BU1 networks whether they overlap with BU1 or not, OR if it is network 1 then the ip address mustn't be in one of the ranges mentioned. Is this not what you are asking for?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...