Splunk Search

Splunk 8 - TSTATS WHERE IN () does not work with CIDR

New Member

Providing Splunk 8 the following:

| tstats allowoldsummaries=t count from datamodel=NetworkTraffic.AllTraffic where (nodename = AllTraffic.TrafficByAction.AllowedTraffic) (AllTraffic.srczone="INET") (AllTraffic.destip= NOT AllTraffic.srcip IN (,, AllTraffic.srcip, All_Traffic.action | sort - count

It doesn't filter out the subnets we asked to exclude... BUT it works on 7.3

Tags (2)
0 Karma

New Member

Nevermind.. Known issue

2019-11-11 SPL-179357, SPL-179700 Negated subnet CIDR filter doesn't work in search.

limits.conf: [search] usesearchevaluator_v2=false

Examples searches that don't filter out values: index=_internal (NOT clientip= | stats count BY clientip

index=_internal (clientip!= | stats count BY clientip

index=internal | stats count BY clientip | search (clientip!= | stats sum(count) BY clientip | noop searchoptimization=false

Filtering with | where is OK: index=_internal | where NOT cidrmatch("", clientip) | stats count BY clientip

0 Karma