Splunk Search

How to filter out event in Splunk -IP address search via CIDR

Loves-to-Learn Lots

Hey Team, I have some 150+ ip addresses in CIDR format (IE, etc) , i am getting my search result with one values coming as  dst_ip 

i need to filter out this event. so basically if it would be one,, i can simply do in my SPL dst_ip!= ( or NOT dst_ip IN ((, 

but i have around 150+ cidr that i need to filter out. i tried to add them into lookup file and it seems cidr in lookfile is not working. can someo

Labels (3)
0 Karma

Super Champion

you have to try something like this to make it work with lookups 




like/accept if it works for you!

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...