LogParser query to grab only external IP addresses from IIS logs?

Question

I tried this question over at ServerFault and didn't have any luck, so I thought I'd try here.

I'm working on a public website that is used by both external visitors and internal employees. I'm after the external visitor hits, but I can't think of a good way to filter out the internal IP ranges.

Using LogParser, what is the best way to filter IISW3C logs by IP range?

This is all I've come up with so far, which can't possibly be the best or most efficient way.

WHERE [c-ip] NOT LIKE (10.10.%, 10.11.%)

Any help is appreciated.

Answer 1

The only other option is to use IPV4_TO_INT and Bitwise functions in your where clause. Personally I think what you have right now will be more readable and easier to maintain.