Why is the CIDR search on accelerated data failing?

[isabel_ycourbe]

When I run my tstat including a CIDR filter with summariesonly=T I got no result, while setting the parameter to false will give me my results:

• Fails: | tstats summariesonly=T count from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest=10.0.0.0/8 by All_Traffic.dest
• Works: | tstats summariesonly=F count from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest=10.0.0.0/8 by All_Traffic.dest but it's obviously slow
• Works: | tstats summariesonly=T count from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest=10.* by All_Traffic.dest where I'm using wildcard instead of CIDR. NB: Datamodel is accelerated at 100% NB2: I testing even with large time range, result is the same

[woodcock · Accepted solution]

Actually, natural CIDR filters work in tstats.

Like this:

| tstats count FROM datamodel=Network_Traffic WHERE index=* AND All_Traffic.src="10.0.0.0/8"

And this:

| tstats count WHERE index=* AND host="10.0.0.0/8"

This has been in Splunk for a long time, but maybe not always. It works in all versions of 7.*

[abpe]

For me CIDR filters on Splunk 7.3.3 fail. For example the query below should list only destinations which are IP's:

| tstats values(Web.dest) as dest from datamodel=Web where Web.dest="0.0.0.0/0"

However it just lists all kind of values.

[harsmarvania57]

As far as I know CIDR isn't supported in tstats commands with accelerated datamodel. Check this answer as well https://answers.splunk.com/answers/468781/how-do-i-do-a-cidr-matchnot-match-in-a-tstats-sear.html

[isabel_ycourbe]

Thanks for the answer and the workaround !