Splunk Search

query optimization on IP adress

Nico99
Explorer

Hello community!

I'm looking for a way to optimize this search below and I need some help :

 

index="oswinsec" source="XmlWinEventLog:Security" TargetUserName Kerberos earliest=-5min
| regex TargetUserName="^([a-z]+)\.([a-z]+)"
| regex IpAddress="\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}" | eval Octet1=mvindex(split(IpAddress,"."), 0) | eval Octet2=mvindex(split(IpAddress,"."), 1) | eval Octet3=mvindex(split(IpAddress,"."), 2) | where (Octet1=10 AND Octet2=244 AND Octet3>=192 AND Octet3<=255) OR (Octet1=172 AND Octet2=24)  
| dedup TargetUserName | table TargetUserName IpAddress

 

 

Thanking you!!

regards

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

What is it you wish to optimize?

Have you looked at the cidrmatch function?

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

Nico99
Explorer

No i hadn't seen this function.
We tried and it's indeed simpler.

Thank you so much!!

richgalloway
SplunkTrust
SplunkTrust

What is it you wish to optimize?

Have you looked at the cidrmatch function?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...