Searching for data from a particular IP range using Splunk
Posted on 2014-10-21
I use Splunk 6 (free) for some basic keyword searching. Generally I just add a specific IP address and a keyword, and I get a hit if it has been indexed. My IP ranges are usually Class C, and I just used something like 10.10.10.* when wanting to search for that particular keyword in the subnet.
Recently I needed to do searches found in much larger IP ranges. For example 126.96.36.199 to 188.8.131.52.
How would I define that range with Splunk? I have looked at some articles, and there they used 184.108.40.206/20 format, but for the life of me I am unable to get it to work in my Splunk searches.
So, if my keyword was "error", and my range was 220.127.116.11 to 18.104.22.168, how would I add that to a Splunk search?