https://community.splunk.com/t5/Alerting/host-communication-to-the-internet/m-p/569540#M13071 <P>Hi, I am trying to create an alert for hosts that are communicating to the internet. Want to know the destinations.&nbsp;</P><P>But have a lot of trusted destinations to exclude (Aprox. 2800).&nbsp;</P><P>The below query gives me all the trusted destinations+other.&nbsp;</P><P>index=net sourcetype=proxy dest!=10.1.* 10.2.* sc_status=200 c_ip IN (10.1.10.* 10.1.11.* ) | lookup dnslookup clientip as c_ip OUTPUT clienthost as DNSName<BR />| stats count by c_ip DNSName dest sc_status</P><P>Please let me know of any solution.&nbsp;</P><P>&nbsp;</P> Mon, 04 Oct 2021 12:15:00 GMT shanaz 2021-10-04T12:15:00Z https://community.splunk.com/t5/Alerting/host-communication-to-the-internet/m-p/569540#M13071 <P>Hi, I am trying to create an alert for hosts that are communicating to the internet. Want to know the destinations.&nbsp;</P><P>But have a lot of trusted destinations to exclude (Aprox. 2800).&nbsp;</P><P>The below query gives me all the trusted destinations+other.&nbsp;</P><P>index=net sourcetype=proxy dest!=10.1.* 10.2.* sc_status=200 c_ip IN (10.1.10.* 10.1.11.* ) | lookup dnslookup clientip as c_ip OUTPUT clienthost as DNSName<BR />| stats count by c_ip DNSName dest sc_status</P><P>Please let me know of any solution.&nbsp;</P><P>&nbsp;</P> Mon, 04 Oct 2021 12:15:00 GMT https://community.splunk.com/t5/Alerting/host-communication-to-the-internet/m-p/569540#M13071 shanaz 2021-10-04T12:15:00Z