inSubnet(address, subnet, maskBits)
In this form address is the database address key field that you would like to test (for example ipServer), subnet and maskBits define the subnet to test against for inclusion. For example inSubnet(ipServer, "10.1.5.0", 24) will return true for any IP server address that is in subnet 10.1.5.0/24. Note the quotes "" around the subnet address.
This form of the filter function can also be used for testing IPv6 addresses for subnet inclusion. For example the inSubnet(ipSource, "2001:db8:a::", 64), can be used to show traffic sourced by any address in the subnet 2001:db8:a::/64.
This example shows the top connections for server addresses in the 10.1.5.0 subnet. It also uses a custom Top N chart that includes serverAddress, serverPort, clientAddress as key fields, so that the connections are not broken out by ephemeral client port. See the help for more information on configuring Custom Top N charts.
inSubnet(address, subnetName)
In this form, address is the database address key field that you would like to test (for example ipSource) and subnetName has previously been defined as a subnet in the sFlowTrend configuration (see the help section on configuring subnets). For example inSubnet(ipSource, "East Bay") will return true for any IP source address that is in the predefined subnet named East Bay.