How to search IP with wildcard?

[mveca]

I want to exclude both primary and secondary IP addresses from a search.

For example:

src_ip!=192.50.244.10 AND src_ip!=192.50.245.10

Can I combine the two by just using a wildcard in just one octet?

For example, something like:

src_ip!=192.50.24*.10

[VatsalJagani]

@mveca - Yes you can do src_ip!=192.50.24*.10.

[DavidHourani]

this excludes 192.50.240.10,192.50.241.10....192.50.249.10 not just the primary IPs.

[VatsalJagani]

I think that's what @mveca wants, "not condition with wildcard".

[DavidHourani · Accepted solution]

Hi @mveca,

You could use a wildcard but that will match more than what you require since that also includes : 192.50.241.10,192.50.242.10 and others that you might want to keep.

If you really want to use a regex you could try something like what is shown here :
https://answers.splunk.com/answers/97697/exclude-regex-results-from-a-search.html

Your search would look like this :

yourbasesearch | regex src_ip!="192.50.24[4,5].10"

Let me know if that helps.

Cheers,
David