Splunk Search

IP FILTER Range

mohdameen81
Observer

HI 

 

please tell me how to write the query for the range of the IP ADDRESS Such as

src!=10.0.0.0/8 To src!=10.24.1.3

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

convert src to a number e.g. A.B.C.D => (A*256*256*256)+(B*256*256)+(C*256)+D and filter by equivalent numbers for your ip range

0 Karma

ashvinpandey
Contributor

@mohdameen81 

The following example uses the cidrmatch function as a filter to remove events that do not match the ip address:

| where cidrmatch("10.0.0.0/8", src)


Also you can use the below command as well if the above one is not working:

| search src>="10.0.0.0/8" src<="10.24.1.3"
Also, If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...