IP Address

[rahmania]

Hi,

I want to find the IP address : 10.1.4.0 to 10.1.41.128 on Splunk Search.
Is there an efficient query than OR ? (index=sources_Ip (sources_ip="10.1.4.0" OR sources_ip="10.1.4.1" OR sources_ip="1.1.4.2" OR ...) )

Thanks

S.V

[richgalloway · Accepted solution]

You could use wildcards to simplify the query.

index=sources_Ip sources_ip="10.1.*"

Or perhaps you can use CIDRs.

index=sources_Ip | where (cidrmatch("10.1.4.0/24", sources_ip) OR cidrmatch("10.1.5.0/24", sources_ip) ...) | ...

[David]

Just a note -- you can also run CIDR matches in the base search. E.g., index=sources_Ip sources_ip=10.1.4.0/24 OR sources_ip=10.1.5.0/24.