For converting to network address from ip address/mask or prefix, I added the following external command lookup to the App below. Usage: | makeresults | eval ip="10.3.3.28/24" | lookup local=t ipcalclookup Address as ip OUTPUT Network Prefix | eval netaddr=Network."/".Prefix Input Address can also be in the following format. * ip/netmask: e.g. 192.0.2.17/255.255.255.240 * ip/prefix: e.g. 192.0.2.17/28 * ipv6/prefix: e.g. 2001:db8:1234::1/64   Numeral system macros for Splunk https://splunkbase.splunk.com/app/6595 ... View more