Splunk Search

IP Address

rahmania
Engager

Hi,

I want to find the IP address : 10.1.4.0 to 10.1.41.128 on Splunk Search.
Is there an efficient query than OR ? (index=sources_Ip (sources_ip="10.1.4.0" OR sources_ip="10.1.4.1" OR sources_ip="1.1.4.2" OR ...) )

Thanks

S.V

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You could use wildcards to simplify the query.

index=sources_Ip sources_ip="10.1.*"

Or perhaps you can use CIDRs.

index=sources_Ip | where (cidrmatch("10.1.4.0/24", sources_ip) OR cidrmatch("10.1.5.0/24", sources_ip) ...) | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You could use wildcards to simplify the query.

index=sources_Ip sources_ip="10.1.*"

Or perhaps you can use CIDRs.

index=sources_Ip | where (cidrmatch("10.1.4.0/24", sources_ip) OR cidrmatch("10.1.5.0/24", sources_ip) ...) | ...
---
If this reply helps you, Karma would be appreciated.

David
Splunk Employee
Splunk Employee

Just a note -- you can also run CIDR matches in the base search. E.g., index=sources_Ip sources_ip=10.1.4.0/24 OR sources_ip=10.1.5.0/24.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...