How to find out the unused IP address from IP ranges?

[TaylorSwift]

hi, all, 

I have an index=myindex, and with two data sourcestype  sourcetype1 includes some IP subnet information just as below:

Description	SubnetID	NetStart	NetEnd	NetBits	NetMask	Site	other_fields
10.168.64.0	10.168.64.0/24	10.168.64.0	10.168.64.255	24	255.255.255.0
100.108.95.68	100.108.95.68/30	00.108.95.68	100.108.95.71	30	255.255.255.252
100.108.24.24	100.108.24.24/30	100.108.24.24	100.108.24.27	30	255.255.255.252

sourcetype2 provides the information about device, include IP address

Device_Name	Mgmt_IP	Site	other_fields
my_device_1	100.108.65.75
my_device_4	100.108.95.70
my_device_10	10.168.64.68

I would like to find the unused IP addresses in every IP range at a specific site.

Any information or guidance will be very appreciated!

Thank you in advance!

[PickleRick]

There is probably more than one way but I think I'd go for converting the network address and netmask to integers (you can do that manually using evals; there is also TA-ipconvert but I hever tried it) and calculating start 32-bit int and end 32-bit int. Then I'd use mvrange to generate all numbers from those ranges.

EDIT: oh, I noticed you already have start and end ip so you might just convert those.

This solves generating base for your search. Append to that contents of your lookup with ips also converted to integers and you can do stats count by ip.

[ITWhisperer]

To get an event for each ip address in the range, try this:

| eval NetStart=split(trim(NetStart),".")
| eval NetEnd=split(trim(NetEnd),".")
| foreach NetStart NetEnd
    [| eval <<FIELD>>=(((((tonumber(mvindex(<<FIELD>>,0))*256)+tonumber(mvindex(<<FIELD>>,1)))*256)+tonumber(mvindex(<<FIELD>>,2)))*256)+tonumber(mvindex(<<FIELD>>,3))]
| eval NetAddr=mvrange(NetStart, NetEnd+1)
| mvexpand NetAddr
| eval NetAddr=(floor(NetAddr/(256*256*256))).".".(floor(NetAddr/(256*256))%256).".".(floor(NetAddr/256)%256).".".(NetAddr%256)