topic Removing 1 IP from a threat Intel list without removing the entire list? in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/Removing-1-IP-from-a-threat-Intel-list-without-removing-the/m-p/446691#M6125 <P>We are using Splunk es. We started porting list into the threat intel feeds. Our analyst wants to remove a single IP from this list and not suppress them. Is there a way of doing this without having to |outputlookup tabling over ip_intel?</P> <P>Anything will help. </P> Fri, 03 May 2019 13:36:22 GMT Alspeedo 2019-05-03T13:36:22Z Removing 1 IP from a threat Intel list without removing the entire list? https://community.splunk.com/t5/Splunk-Enterprise-Security/Removing-1-IP-from-a-threat-Intel-list-without-removing-the/m-p/446691#M6125 <P>We are using Splunk es. We started porting list into the threat intel feeds. Our analyst wants to remove a single IP from this list and not suppress them. Is there a way of doing this without having to |outputlookup tabling over ip_intel?</P> <P>Anything will help. </P> Fri, 03 May 2019 13:36:22 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Removing-1-IP-from-a-threat-Intel-list-without-removing-the/m-p/446691#M6125 Alspeedo 2019-05-03T13:36:22Z Re: Removing 1 IP from a threat Intel list without removing the entire list? https://community.splunk.com/t5/Splunk-Enterprise-Security/Removing-1-IP-from-a-threat-Intel-list-without-removing-the/m-p/446692#M6126 <P>That is only way if you don't have expiration setup and cannot wait for it to expire out.</P> <PRE><CODE> | inputlookup ip_intel where NOT ip="x.x.x.x" | outputlookup ip_intel </CODE></PRE> Fri, 03 May 2019 15:13:16 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Removing-1-IP-from-a-threat-Intel-list-without-removing-the/m-p/446692#M6126 starcher 2019-05-03T15:13:16Z