https://community.splunk.com/t5/Security/Query-for-any-suspicious-IP-address/m-p/506285#M11586 Questions to help clarify the problem.<BR />What do you consider a "suspicious IP address"?<BR />If the IP range was already blocked then how will an IP address in that range appear in the top ten? Fri, 26 Jun 2020 12:47:15 GMT richgalloway 2020-06-26T12:47:15Z https://community.splunk.com/t5/Security/Query-for-any-suspicious-IP-address/m-p/506276#M11585 <P>I'm looking for a splunk query for any suspicious IP address associated with an IP range that was already blocked in the top ten.</P><P>Thank you,</P> Fri, 26 Jun 2020 10:43:13 GMT https://community.splunk.com/t5/Security/Query-for-any-suspicious-IP-address/m-p/506276#M11585 ephrem3232 2020-06-26T10:43:13Z https://community.splunk.com/t5/Security/Query-for-any-suspicious-IP-address/m-p/506285#M11586 Questions to help clarify the problem.<BR />What do you consider a "suspicious IP address"?<BR />If the IP range was already blocked then how will an IP address in that range appear in the top ten? Fri, 26 Jun 2020 12:47:15 GMT https://community.splunk.com/t5/Security/Query-for-any-suspicious-IP-address/m-p/506285#M11586 richgalloway 2020-06-26T12:47:15Z