cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Who rated this post

L6 Presenter

I think you should target Endpoint data set. Please refer to below query:
dataset = endpoints
| fields endpoint_name as agent_hostname, ip_address as agent_ip_address
| arrayexpand agent_ip_address
| filter not incidr(agent_ip_address, "10.0.0.0/24")
and not incidr(agent_ip_address, "172.16.0.0/20")
and not incidr(agent_ip_address, "192.168.0.0/16")

 

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Ashutosh Patil

View solution in original post

Who rated this post