Splunk Search

eval case/cidrmatch using two fields as a condition


How can I use cidrmatch or case using 2 conditions?

Example: I only want to get list of IPs where row_A is and row_B is

Current Table:
row_A row_B

Target Result:
row_A row_B


Tags (2)
0 Karma


hi @whitefang1726,

Use where command like this:

| where cidrmatch("", row_A) and cidrmatch("", row_B)

Smaple query:

| makeresults 
| eval _raw=" row_A row_B" 
| multikv forceheader=1 
| where cidrmatch("", row_A) and cidrmatch("", row_B)
| fields - _raw, _time, linecount
0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...