One of our users has beought forth the following question: I would like to be able to determine if IP Addresses from China are attempting to hit one or more of our servers. I have a list IP ranges for China in CIDR Notation, to the tune of 3400+, ranges. I have figured out how to make a query using the cidrmatch function, but I am afraid that a query of this nature may cause a severe negative impact on the performance of our Splunk environment. The basics of the query that I have put together are: host=myhost AND error_code-12345 | where (cidrmatch("cidrblk1/24", src) OR cidrmatch("cidrblk2/17", src) OR cidrmatch("cidrblk3/19", src) OR...) Is there a better, more efficient way, "SAFER" way to handle this? Is there a better way to handle this? ... View more