Filter results by IP address

robK123 — Mon, 26 Nov 2012 10:53:04 GMT

Hi,

I have a search result that shows IP addresses that query a DNS server but how do I filter the search result to only show a particular host IP address.

The search so far just returns all results:

index="DNS-misc" sourcetype="named-query"

Thanks,

Re: Filter results by IP address

martin_mueller — Mon, 26 Nov 2012 10:59:46 GMT

Assuming the events contain the IP you're looking for and you want to show events containing 1.2.3.4 only you can do this:

index="DNS-misc" sourcetype="named-query" 1.2.3.4

If the filtered IP is extracted to a field, for example "host", you can do this:

index="DNS-misc" sourcetype="named-query" host=1.2.3.4

topic Re: Filter results by IP address in Getting Data In

Filter results by IP address

Re: Filter results by IP address