topic Re: Filter out my own source IP Address in Getting Data In

Filter out my own source IP Address

Kai191 — Mon, 01 Apr 2013 07:52:58 GMT

I have my search command as source="C:\Users\L30814\Desktop\1713.log" http | top 10 DestinationIP. What is the additional command to add in in order to filter out my own source IP Address??

Re: Filter out my own source IP Address

gfuente — Mon, 01 Apr 2013 08:05:02 GMT

Hello

You could try something like:

source="C:\Users\L30814\Desktop\1713.log" http NOT "xxx.xxx.xxx.xxx" |  top 10 DestinationIP

But this would filter any event with that ip adress, not just "source" adresses.

If you have the field extracted you can do it better with this command:

source="C:\Users\L30814\Desktop\1713.log" http AND c_ip!="xxx.xxx.xxx.xxx" |  top 10 DestinationIP

Supposing that you source ip adress is extracted in the field c_ip

Regards

Re: Filter out my own source IP Address

Kai191 — Mon, 01 Apr 2013 08:28:28 GMT

Thaks a lot!

Re: Filter out my own source IP Address

gfuente — Mon, 01 Apr 2013 09:03:52 GMT

No problem

You can mark it as "Correct answer" if you think it´s correct. Thanks