Splunk Search

How to use regex to look for hosts from /24, /25, and /26 subnets?

rholm01
Explorer

I have a dozen /24 subnets that I am looking to find any IP addresses on that subnet in my search as well as a addresses from several /25 and /26 subnets. Thanks, in advance.

0 Karma

woodcock
Esteemed Legend

Standard searches and tstats ... where both support native CIDR equalities (but NOT inequalities) and where has cidrmatch() function.

0 Karma

dmarling
Builder

I believe you may make more hay by using a where clause and a cidrmatch function: https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/ConditionalFunctions#cidrmatch.28...
Example: | where cidrmatch("123.132.32.0/25", ip)

If this comment/answer was helpful, please up vote it. Thank you.
0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...