… | where like(src, “10.9.165.%”) OR cidrmatch(“10.9.165.0/25”, dst) What will this search return as a result?

[rashokciet]

… | where like(src, “10.9.165.%”) OR cidrmatch(“10.9.165.0/25”, dst)

What will this search return as a result?

Any help is appreciated..!

[esix_splunk]

By syntax, CIDRMATCH("10.9.165.0/25",dst) will return 10.9.165 - 166. 1 - 254.

Whereas.. WHERE like(src,"10.9.165.%") will only return any src that is 10.9.165.x.

[Runals]

Actually cidermatch("10.9.165.0/25", dst) will return values between 10.9.165.0 - 10.9.165.127
where like(src, "10.9.165.%") will return values that simply start with "10.9.165." and while one might assume validation has already been done to the data in "src" it will match 0-255 but also any string of characters

[ngatchasandra · Accepted solution]

Hi,

I think that It return events that match the IP or is in the specified subnet.

This because:

• the like(x,y) funtion This function takes two arguments, a field X and a quoted string Y, and
  returns TRUE if and only if the first argument is like the SQLite pattern in y

• the cidrmacth(x,y) function identifies IP addresses that belong to a particular subnet. The function uses two arguments: the first is the CIDR subnet, is contained in quotes; the second is the IP address to match, which may be values in field.

[rashokciet]

Could you please explain how it works??

Thanks for the help in advance

[ngatchasandra]

Yes!

This because:

• the like(x,y) funtion This function takes two arguments, a field X and a quoted string Y, and returns TRUE if and only if the first argument is like the SQLite pattern in y

• the cidrmacth(x,y) function identifies IP addresses that belong to a particular subnet. The function uses two arguments: the first is the CIDR subnet, is contained in quotes; the second is the IP address to match, which may be values in field.