Splunk Search

Why is the CIDR search on accelerated data failing?

Path Finder

When I run my tstat including a CIDR filter with summariesonly=T I got no result, while setting the parameter to false will give me my results:

  • Fails: | tstats summariesonly=T count from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest=10.0.0.0/8 by All_Traffic.dest
  • Works: | tstats summariesonly=F count from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest=10.0.0.0/8 by All_Traffic.dest but it's obviously slow
  • Works: | tstats summariesonly=T count from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest=10.* by All_Traffic.dest where I'm using wildcard instead of CIDR. NB: Datamodel is accelerated at 100% NB2: I testing even with large time range, result is the same
0 Karma
1 Solution

Esteemed Legend

Actually, natural CIDR filters work in tstats.

Like this:

| tstats count FROM datamodel=Network_Traffic WHERE index=* AND All_Traffic.src="10.0.0.0/8"

And this:

| tstats count WHERE index=* AND host="10.0.0.0/8"

This has been in Splunk for a long time, but maybe not always. It works in all versions of 7.*

View solution in original post

0 Karma

Esteemed Legend

Actually, natural CIDR filters work in tstats.

Like this:

| tstats count FROM datamodel=Network_Traffic WHERE index=* AND All_Traffic.src="10.0.0.0/8"

And this:

| tstats count WHERE index=* AND host="10.0.0.0/8"

This has been in Splunk for a long time, but maybe not always. It works in all versions of 7.*

View solution in original post

0 Karma

Path Finder

For me CIDR filters on Splunk 7.3.3 fail. For example the query below should list only destinations which are IP's:

| tstats values(Web.dest) as dest from datamodel=Web where Web.dest="0.0.0.0/0"

However it just lists all kind of values.

0 Karma

SplunkTrust
SplunkTrust

As far as I know CIDR isn't supported in tstats commands with accelerated datamodel. Check this answer as well https://answers.splunk.com/answers/468781/how-do-i-do-a-cidr-matchnot-match-in-a-tstats-sear.html

0 Karma

Path Finder

Thanks for the answer and the workaround !

0 Karma