https://community.splunk.com/t5/Splunk-Search/Predefined-Group/m-p/490403#M136935 <P>What is the best way to define a "group" of ip subnets called server_subnet then use that in searches.</P> <P>I have about 19 subnets used to host our server fleet and I would like to define these subnets and assign a name such as server_subnets so I can then write a search that references that name. For example</P> <PRE><CODE>index="*" src_ip="server_subnets" | stats count by host </CODE></PRE> <P>OR</P> <PRE><CODE>index="*" dest_ip!="server_subnets" </CODE></PRE> <P>Thanks</P> Wed, 22 Jan 2020 23:18:36 GMT balcv 2020-01-22T23:18:36Z https://community.splunk.com/t5/Splunk-Search/Predefined-Group/m-p/490403#M136935 <P>What is the best way to define a "group" of ip subnets called server_subnet then use that in searches.</P> <P>I have about 19 subnets used to host our server fleet and I would like to define these subnets and assign a name such as server_subnets so I can then write a search that references that name. For example</P> <PRE><CODE>index="*" src_ip="server_subnets" | stats count by host </CODE></PRE> <P>OR</P> <PRE><CODE>index="*" dest_ip!="server_subnets" </CODE></PRE> <P>Thanks</P> Wed, 22 Jan 2020 23:18:36 GMT https://community.splunk.com/t5/Splunk-Search/Predefined-Group/m-p/490403#M136935 balcv 2020-01-22T23:18:36Z https://community.splunk.com/t5/Splunk-Search/Predefined-Group/m-p/490404#M136936 <P>@balcv ,</P> <P>You may use <CODE>tags</CODE> or <CODE>eventtypes</CODE> to group fields/values</P> <P>Most of the options are detailed in the <A href="https://docs.splunk.com/Documentation/Splunk/latest/Search/Classifysimilarevents">Classify and group similar events</A></P> Thu, 23 Jan 2020 07:53:36 GMT https://community.splunk.com/t5/Splunk-Search/Predefined-Group/m-p/490404#M136936 renjith_nair 2020-01-23T07:53:36Z