Splunk Search
Highlighted

search cidr without using "src_ip OR dest_ip"?

New Member

Is there a way to search a cidr notation without using "srcip OR destip"?
I have a bunch of ips i want to search for and would like to search for a bunch of them at once.

Tags (2)
0 Karma
Highlighted

Re: search cidr without using "src_ip OR dest_ip"?

Builder

If you don't use a field name the search command will interpret the CIDR as a string, it will not make a match. You must use a field name in the search, like srcip or destip.

0 Karma