Splunk Search

How to use regex to look for hosts from /24, /25, and /26 subnets?

rholm01
Explorer

I have a dozen /24 subnets that I am looking to find any IP addresses on that subnet in my search as well as a addresses from several /25 and /26 subnets. Thanks, in advance.

0 Karma

woodcock
Esteemed Legend

Standard searches and tstats ... where both support native CIDR equalities (but NOT inequalities) and where has cidrmatch() function.

0 Karma

dmarling
Builder

I believe you may make more hay by using a where clause and a cidrmatch function: https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/ConditionalFunctions#cidrmatch.28...
Example: | where cidrmatch("123.132.32.0/25", ip)

If this comment/answer was helpful, please up vote it. Thank you.
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...