topic Re: Splunk Query Exclude Question in Splunk Search

Splunk Query Exclude Question

johann2017 — Mon, 26 Mar 2018 20:45:22 GMT

I am building a search query and trying to find the correct syntax to exclude specific combinations of source and destination IP addresses. For instance, in the search results I want to exclude results only between specific source and destination IPs. So if there is a lot of traffic happening between 192.168.1.5 and 192.168.1.20 I want to only exclude traffic between those two IPs, but still see traffic between 192.168.1.5 and other IPs.

Re: Splunk Query Exclude Question

tiagofbmm — Mon, 26 Mar 2018 21:34:37 GMT

Hey

Imagine you want to exclude some combinations you have in a lookup, you could use:

yoursearch | NOT ( [ | inputlookup ipscombination | return 1000 source ,dest | rex field="search" mode=sed "s/OR/AND/g" ]

That would exclude the combinations of source/dest you have in a lookup.

Re: Splunk Query Exclude Question

skoelpin — Tue, 27 Mar 2018 01:06:15 GMT

cidrmatch is what your looking for

| eval IP_Range = if(cidrmatch("192.168.1.5/25",ip), "local", "not local"))

http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/ConditionalFunctions

Re: Splunk Query Exclude Question

skoelpin — Wed, 28 Mar 2018 13:45:01 GMT

@johann2017 did this work for you?

Re: Splunk Query Exclude Question

johann2017 — Thu, 05 Apr 2018 21:11:08 GMT

Hello Skoelpin. I don't think cidrmatch is what I need?

Re: Splunk Query Exclude Question

johann2017 — Thu, 05 Apr 2018 21:12:02 GMT

Hey Tiago - where exactly in the query do I place the IP addresses? Does this work for only 2 IPs? Will it work for more than 2?