Analytics filter by Source IP and CIDR ranges

[junior delta]

Hey folks,

Goal - is to filter by a bulk list of IPs or a CIDR range ideally in Analytics or Security Events/Analytics.

For example - I was trying to search for all IPs similar to 198.2.237.112 by trying 198.2.0.0/16 but it was saying invalid source IP. And/Or I can't see where I can make use of filtering with an IP list (that would be great!).

Hopefully doing something silly! Thanks

[ancient geyser]

For CIDR Ranges you have to use the is in operator, click where equals is

[junior delta]

thanks @ancient geyser but I was doing that for Analytics accepts the input format but yields no results. Security Events won't accept the CIDR range format (it drops the create option).

Taking Google Bots as an example - 66.249.0.0/16 doesn't return any results when there has been millions of requests from that range within last 30 days.

[ancient geyser]

hmmm yea my bad, I thought it was an option and saw a community post on it so figured I was remembering right, but evidently not or it totally changed. Even the GraphQL in operator doesn't work with it. You can specify a manual list with is in or do it by ASN (ASN is usually easier) or some other fields/combo like Country or Country + ASN