Splunk Search

IPv6 subnet as search parameter does not work (but IPv4 does!)

npichugin
Path Finder

Hello,

Let's say I'm trying to search for events where src_ip field matches some subnet:

search index=myindex src_ip="1.2.0.0/16"

This works perfectly. Now I want to run a similar search, but for IPv6 subnet:

search index=myindex src_ip6="1234:5678::/32"

This does NOT work. However, cidrmatch() function in "where" command works for both IPv4 and IPv6, so I consider search behaviour described above to be a bug.
Is this a known issue for Splunk developers? Is there a way to workaround this without using cidrmatch()?

P.S. Is it OK to report bugs here at splunkbase? I didn't found the Splunk bugtracker...

Tags (4)

_d_
Splunk Employee
Splunk Employee

While lookups and the cidrmatch function work with IPv6 CIDR notation, a direct search (similar to your first one with IPv4) does not. It is a known internal requirement that will be tentatively solved in a future release.

npichugin
Path Finder

Thanks for clarifying!

0 Karma

npichugin
Path Finder

Thank you very much! I'll file this issue there.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Reporting suspected bugs here is quite okay, the more direct approach would be to submit a case here: https://www.splunk.com/page/submit_issue

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...