Solved

Searching for data from a particular IP range using Splunk

Posted on 2014-10-21
1
2,357 Views
Last Modified: 2014-11-02
I use Splunk 6 (free) for some basic keyword searching.  Generally I just add a specific IP address and a keyword, and I get a hit if it has been indexed.  My IP ranges are usually Class C, and I just used something like 10.10.10.* when wanting to search for that particular keyword in the subnet.

Recently I needed to do searches found in much larger IP ranges.  For example 101.2.176.0 to 101.2.191.255.
How would I define that range with Splunk?  I have looked at some articles, and there they used 101.2.176.0/20 format, but for the life of me I am unable to get it to work in my Splunk searches.

So, if my keyword was "error", and my range was 101.2.176.0 to 101.2.191.255, how would I add that to a Splunk search?
0
Comment
Question by:hbcit
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 63

Accepted Solution

by:
btan earned 500 total points
ID: 40396391
Probably tab on the answers.splunk forum for such queries, I input the "ip range" to search in the forum as below.
http://answers.splunk.com/search.html?f=&redirect=search%2Fsearch&sort=relevance&q=ip+range&type=question

Some may be useful below.

Search for multiple IP ranges - using where and cidrmatch or octet range rule
http://answers.splunk.com/answers/13251/search-for-multiple-ip-ranges.html

Using CIDR in a lookup table - Create a CSV lookup table with your subnets
http://answers.splunk.com/answers/5916/using-cidr-in-a-lookup-table.html

Conditional search for multiple IP ranges e.g. IP regex such as regex clientaddress="10\.([1-9]|[1-9][0-9]|1[0-9][0-9]|200)\.([8-9][0-9]|1[0-9][0-9])\.(2(3[1-9]|4[0-9]|5[0-4]))"
http://answers.splunk.com/answers/13251/search-for-multiple-ip-ranges.html
0

Featured Post

Connect further...control easier

With the ATEN CE624, you can now enjoy a high-quality visual experience powered by HDBaseT technology and the convenience of a single Cat6 cable to transmit uncompressed video with zero latency and multi-streaming for dual-view applications where remote access is required.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

PRTG Network Monitor lets you monitor your bandwidth usage, so you know who is using up your bandwidth, and what they're using it for.
This article is a collection of issues that people face from time to time and possible solutions to those issues. I hope you enjoy reading it.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question