topic Re: Grouping Client Ips in Splunk Search

Grouping Client Ips

xvxt006 — Wed, 19 Jun 2013 23:04:47 GMT

Hi,

We have different set of clientIPs and we want to group them so that we can either group them by or exclude that group or something like that..Do you have any suggestions whether to create as an events/macros/tags would give more value?

Re: Grouping Client Ips

asimagu — Thu, 20 Jun 2013 04:07:10 GMT

If you have all the IP's addresses the best way to proceed would be using automatic lookups and thus creating a new field, then use the values of that field to do the grouping.

If you don't have the full IP addresses and just want to group them depending on the network they belong to, I would use the 'eval' command to create a new field based on whatever rule you need to create the grouping.

Re: Grouping Client Ips

xvxt006 — Thu, 20 Jun 2013 04:42:43 GMT

Hi Thanks for the response. We have some IPs that are white listed. For examle if we have 1000 ips, out of those i know about 100 of them. Say 10 are from xxx company and 50 are from yyy and 40 are from zzz company. So do you think i can still use automatic lookups?

Re: Grouping Client Ips

asimagu — Mon, 28 Sep 2020 14:08:17 GMT

yes, you just need a lookup like this, and the IP address that are not included there will not get any value in the field 'company', or you could set a default value too

IP,company
IP_sample_1,xxx
IP_sample_2,xxx
...
..
IP_sample_3,yyy
IP_sample_4,xxx
IP_sample_5,zzz
..
.
IP_sample_6,zzz
IP_sample_7,xxx

Re: Grouping Client Ips

Ayn — Thu, 20 Jun 2013 10:35:50 GMT

Additionally you could even define net ranges if that's more convenient, and then specify the lookup type to be cidr. Splunk understands cidr notation.