I'm trying to come up with a way to output to a lookup file a list of calculated network addresses given a list of IP addresses. By using a destination MAC address and a source IP, I'm able to group together a list of IPs that are using the same gateway with the following: `index=zeek sourcetype=zeek_conn | stats values(src) by resp_l2_addr` But from here, I need to take those src values and have Splunk give me the smallest subnet that covers that range of addresses. For example, if I have 10.0.0.5 and 10.0.1.5 in the same list, I would need the query to say, based on these two addresses, there is a 10.0.0.0/23 network. I feel this is more of a machine learning type of problem, but wanted to see if anyone has come up with something similar that could solve this. Thanks! ... View more