I have hits for SourceIP:"10.191.33.200" but not for SourceIP:"10.191.33.*" What is the correct syntax assuming field is string type not ip_addr?
Remove the quotes:
SourceIP: 10.191.33.*
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.