Skip to content

Instantly share code, notes, and snippets.

@lowell80
lowell80 / cidr2regex.py
Last active November 22, 2023 16:28 — forked from waffle2k/cidr2regex.py
Splunk deployment based on CIDR
#!/usr/bin/env python
''' Splunk deployment based on CIDR
Splunk's deployment server does not support CIDR based matching out of the box,
but they do support PCRE regex matching. I found this script online and
modified it slightly to match Splunk's specific regex variation. (Basically,
Splunk uses standards PCRE but replace the meaning of "." and "*" to act more
like traditional glob strings.) The values returned by this script can be
used in the serverclass.conf for either whitelist.<n> or blacklist.<n> values.
See the Splunk docs for more details.