https://community.splunk.com/t5/Getting-Data-In/How-to-combine-lists-of-source-and-destination-IPs-into-one/m-p/235801#M45879 <P>I have a list of source and destination IPs that I'm trying to concatenate into one unique list and check against a CSV file. I'm trying to make a list of all the unique source IPs (I don't need the count, but it'd be nice), add that to a list of unique destination IPs, then take all that and display only the IPs that match a CSV file I have. Does anyone have an idea of how to do that?</P> Mon, 09 May 2016 21:00:13 GMT ststephe 2016-05-09T21:00:13Z https://community.splunk.com/t5/Getting-Data-In/How-to-combine-lists-of-source-and-destination-IPs-into-one/m-p/235801#M45879 <P>I have a list of source and destination IPs that I'm trying to concatenate into one unique list and check against a CSV file. I'm trying to make a list of all the unique source IPs (I don't need the count, but it'd be nice), add that to a list of unique destination IPs, then take all that and display only the IPs that match a CSV file I have. Does anyone have an idea of how to do that?</P> Mon, 09 May 2016 21:00:13 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-combine-lists-of-source-and-destination-IPs-into-one/m-p/235801#M45879 ststephe 2016-05-09T21:00:13Z https://community.splunk.com/t5/Getting-Data-In/How-to-combine-lists-of-source-and-destination-IPs-into-one/m-p/235802#M45880 <P>Like this:</P> <PRE><CODE>... | dedup myIPfield | table myIPfield | eval dataSource="events" | appendpipe [|inputcsv myIPfile.csv | table myIPfield | eval dataSource="CSV"] | stats values(*) AS * dc(dataSource) AS numSources BY myIPfield ... </CODE></PRE> <P>Then you can finish out with:</P> <P>For inner join:</P> <PRE><CODE>| where numSources=2 </CODE></PRE> <P>For left join:</P> <PRE><CODE>| where dataSource="events" </CODE></PRE> <P>For right join:</P> <PRE><CODE>| where dataSource="CSV" </CODE></PRE> <P>For outer join:</P> <PRE><CODE>| where numSources=1 </CODE></PRE> Mon, 09 May 2016 21:14:47 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-combine-lists-of-source-and-destination-IPs-into-one/m-p/235802#M45880 woodcock 2016-05-09T21:14:47Z https://community.splunk.com/t5/Getting-Data-In/How-to-combine-lists-of-source-and-destination-IPs-into-one/m-p/235803#M45881 <P>What you're trying to do is definitely possible but it would be tough to give a solution without knowing your data (is source and dest ip present in same event, how is the CSV file stored in splunk;)...</P> Mon, 09 May 2016 21:19:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-combine-lists-of-source-and-destination-IPs-into-one/m-p/235803#M45881 somesoni2 2016-05-09T21:19:24Z