Splunk Search

How to use regex to look for hosts from /24, /25, and /26 subnets?

rholm01
Explorer

I have a dozen /24 subnets that I am looking to find any IP addresses on that subnet in my search as well as a addresses from several /25 and /26 subnets. Thanks, in advance.

0 Karma

woodcock
Esteemed Legend

Standard searches and tstats ... where both support native CIDR equalities (but NOT inequalities) and where has cidrmatch() function.

0 Karma

dmarling
Builder

I believe you may make more hay by using a where clause and a cidrmatch function: https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/ConditionalFunctions#cidrmatch.28...
Example: | where cidrmatch("123.132.32.0/25", ip)

If this comment/answer was helpful, please up vote it. Thank you.
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...