https://community.splunk.com/t5/Splunk-Enterprise-Security/splunk-search-query/m-p/496476#M8599 <P>Hi</P> <P>suppose I have this IP address 10.5.5.5</P> <P>I just want to see any information that splunk has on this IP. I'm starting with a wide search. </P> <P>What would the search query look like? If I simply type this in, it doesn't work: index=* 10.5.5.5<BR /> At minimum would that mean I need to specific a field for the IP address? </P> Tue, 03 Dec 2019 20:12:12 GMT trojan_81 2019-12-03T20:12:12Z https://community.splunk.com/t5/Splunk-Enterprise-Security/splunk-search-query/m-p/496476#M8599 <P>Hi</P> <P>suppose I have this IP address 10.5.5.5</P> <P>I just want to see any information that splunk has on this IP. I'm starting with a wide search. </P> <P>What would the search query look like? If I simply type this in, it doesn't work: index=* 10.5.5.5<BR /> At minimum would that mean I need to specific a field for the IP address? </P> Tue, 03 Dec 2019 20:12:12 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/splunk-search-query/m-p/496476#M8599 trojan_81 2019-12-03T20:12:12Z https://community.splunk.com/t5/Splunk-Enterprise-Security/splunk-search-query/m-p/496477#M8600 <P>Use quotations marks around it (See below). Also think about the time range you're searching, there might not be results for that ip in your time range.<BR /> Also, check out this Search Tutorial for more useful tips: <A href="https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchTutorial/WelcometotheSearchTutorial">https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchTutorial/WelcometotheSearchTutorial</A> </P> <PRE><CODE> index=* "10.5.5.5" </CODE></PRE> Tue, 03 Dec 2019 20:37:55 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/splunk-search-query/m-p/496477#M8600 oscar84x 2019-12-03T20:37:55Z