topic importing IP List in Getting Data In

importing IP List

TucoRameriz — Tue, 16 Apr 2013 18:27:30 GMT

Sorry in advance to the newbie question but, is there a way to import a list of IP addresses into splunk search query?

For example, I come across a couple of pieces of malware and identify the call back addresses which could number into the dozens or even hundreds. I would like to be able to import a list with these addresses into Splunk and run those across my Web Logs looking for any activity.

Thanks

Re: importing IP List

Ayn — Tue, 16 Apr 2013 19:36:05 GMT

This is a prime example of what you could use a subsearch for. http://docs.splunk.com/Documentation/Splunk/5.0.2/Tutorial/Useasubsearch

Given a lookup table (yourlookuptable) with a list of ip's (field ip), you could do

[| inputlookup yourlookuptable | field ip]

Re: importing IP List

kristian_kolb — Tue, 16 Apr 2013 19:41:44 GMT

Have a look at lookups in the docs, also the command inputcsv or inputlookup may prove fruitful;

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Inputlookup
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Inputcsv

Re: importing IP List

kristian_kolb — Tue, 16 Apr 2013 19:42:33 GMT

editing again.....