Splunk Search

Splunk 8 - TSTATS WHERE IN () does not work with CIDR

New Member

Providing Splunk 8 the following:

| tstats allowoldsummaries=t count from datamodel=NetworkTraffic.AllTraffic where (nodename = AllTraffic.TrafficByAction.AllowedTraffic) (AllTraffic.srczone="INET") (AllTraffic.destip=172.20.17.119) NOT AllTraffic.srcip IN (40.96.0.0/13, 40.104.0.0/15, 52.96.0.0/14)by AllTraffic.srcip, All_Traffic.action | sort - count

It doesn't filter out the subnets we asked to exclude... BUT it works on 7.3

Tags (2)
0 Karma

New Member

Nevermind.. Known issue
https://docs.splunk.com/Documentation/Splunk/8.0.0/ReleaseNotes/KnownIssues

2019-11-11 SPL-179357, SPL-179700 Negated subnet CIDR filter doesn't work in search.

Workaround:
Workaround:
limits.conf: [search] usesearchevaluator_v2=false

Examples searches that don't filter out values: index=_internal (NOT clientip=127.0.0.0/8) | stats count BY clientip

index=_internal (clientip!=127.0.0.0/8) | stats count BY clientip

index=internal | stats count BY clientip | search (clientip!=127.0.0.0/8) | stats sum(count) BY clientip | noop searchoptimization=false

Filtering with | where is OK: index=_internal | where NOT cidrmatch("127.0.0.0/8", clientip) | stats count BY clientip

0 Karma