Adding IP's to a exposed text file

arunkuriakose — Mon, 03 May 2021 09:13:05 GMT

Hi Team

I want to collect source ip from an alert triggered /search ran and then add that to a .txt file exposed on a separate server.(https://urlofserver/ipfile.txt)

What is the best way to achieve this

Re: Adding IP's to a exposed text file

aasabatini — Mon, 03 May 2021 09:55:14 GMT

Hi @arunkuriakose

you can add on your alert action an sh script to save all result ip on your txt file.

https://docs.splunk.com/Documentation/Splunk/8.1.3/AdvancedDev/CustomAlertScript

or if in your case works fine a csv file you can add on your alert search the outputlookup comand to save the results in a new csv file.

https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Outputlookup

topic Re: Adding IP's to a exposed text file in Alerting

Adding IP's to a exposed text file

Re: Adding IP's to a exposed text file