Solved

Searching for data from a particular IP range using Splunk

Posted on 2014-10-21
1
2,076 Views
Last Modified: 2014-11-02
I use Splunk 6 (free) for some basic keyword searching.  Generally I just add a specific IP address and a keyword, and I get a hit if it has been indexed.  My IP ranges are usually Class C, and I just used something like 10.10.10.* when wanting to search for that particular keyword in the subnet.

Recently I needed to do searches found in much larger IP ranges.  For example 101.2.176.0 to 101.2.191.255.
How would I define that range with Splunk?  I have looked at some articles, and there they used 101.2.176.0/20 format, but for the life of me I am unable to get it to work in my Splunk searches.

So, if my keyword was "error", and my range was 101.2.176.0 to 101.2.191.255, how would I add that to a Splunk search?
0
Comment
Question by:hbcit
1 Comment
 
LVL 62

Accepted Solution

by:
btan earned 500 total points
ID: 40396391
Probably tab on the answers.splunk forum for such queries, I input the "ip range" to search in the forum as below.
http://answers.splunk.com/search.html?f=&redirect=search%2Fsearch&sort=relevance&q=ip+range&type=question

Some may be useful below.

Search for multiple IP ranges - using where and cidrmatch or octet range rule
http://answers.splunk.com/answers/13251/search-for-multiple-ip-ranges.html

Using CIDR in a lookup table - Create a CSV lookup table with your subnets
http://answers.splunk.com/answers/5916/using-cidr-in-a-lookup-table.html

Conditional search for multiple IP ranges e.g. IP regex such as regex clientaddress="10\.([1-9]|[1-9][0-9]|1[0-9][0-9]|200)\.([8-9][0-9]|1[0-9][0-9])\.(2(3[1-9]|4[0-9]|5[0-4]))"
http://answers.splunk.com/answers/13251/search-for-multiple-ip-ranges.html
0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

#Citrix #Citrix Netscaler #HTTP Compression #Load Balance
David Varnum recently wrote up his impressions of PRTG, based on a presentation by my colleague Christian at Tech Field Day at VMworld in Barcelona. Thanks David, for your detailed and honest evaluation!
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question