Given an IP network address and it’s netmask represented under integer format, the bellow search will create a CIDR representation from the lookup without using built-in tools.

|inputlookup geoip | head 100

| eval mask_int=end_ip_int-start_ip_int

| eval mask_bin=replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(substr(tostring(mask_int, "hex"), 3), "0", "0000"), "1", "0001"), "2", "0010"), "3", "0011"), "4", "0100"), "5", "0101"), "6", "0110"), "7", "0111"), "8", "1000"), "9", "1001"), "A", "1010"), "B", "1011"), "C", "1100"), "D", "1101"), "E", "1110"), "F", "1111")

| eval mask_bin=ltrim(tostring(mask_bin),"0")

| eval mask_cidr=32-length(mask_bin)

| eval cidr=start_ip_oct . "/" . mask_cidr
| table start_ip_oct, end_ip_oct, cidr

|inputlookup geoip | head 100 | eval mask_int=end_ip_int-start_ip_int | eval mask_cidr=32-ceiling(log(mask_int,2)) | eval cidr=start_ip_oct . "/" . mask_cidr
| table start_ip_oct, end_ip_oct, cidr