Is there a way to search a cidr notation without using "src_ip OR dest_ip"?
I have a bunch of ips i want to search for and would like to search for a bunch of them at once.
If you don't use a field name the search command will interpret the CIDR as a string, it will not make a match. You must use a field name in the search, like src_ip or dest_ip.