https://community.splunk.com/t5/Splunk-Search/Is-there-anyway-to-create-a-file-with-a-list-of-IP-s-that-i-can/m-p/587232#M204526 <P>Read about "outputlookup" command to dynamically build your lookup from your search (<A href="https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Outputlookup" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Outputlookup</A>).&nbsp;</P><P>Here is a reference on how to use lookup as search filter:&nbsp;<A href="https://community.splunk.com/t5/Alerting/How-to-do-a-filtered-list-out-of-a-lookup-table/m-p/257806" target="_blank">https://community.splunk.com/t5/Alerting/How-to-do-a-filtered-list-out-of-a-lookup-table/m-p/257806</A></P> Wed, 02 Mar 2022 13:58:50 GMT somesoni2 2022-03-02T13:58:50Z https://community.splunk.com/t5/Splunk-Search/Is-there-anyway-to-create-a-file-with-a-list-of-IP-s-that-i-can/m-p/587209#M204518 <P>is there anyway to create a file with a list of IP's that i can use in the search field? i am trying to search for IP's that are not in this specific list but i don't want to create the list for every search.</P> <P>For instance if i want to look through zeek conn.log for bad_guy IP's from a predefined list of bad guy IP's.</P> <P>Thank you for any help.</P> Wed, 02 Mar 2022 23:08:14 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-anyway-to-create-a-file-with-a-list-of-IP-s-that-i-can/m-p/587209#M204518 tazzvon 2022-03-02T23:08:14Z https://community.splunk.com/t5/Splunk-Search/Is-there-anyway-to-create-a-file-with-a-list-of-IP-s-that-i-can/m-p/587214#M204523 <P>You could consider creating a lookup table with the bad ip addresses, and using that to filter your search</P> Wed, 02 Mar 2022 13:07:00 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-anyway-to-create-a-file-with-a-list-of-IP-s-that-i-can/m-p/587214#M204523 ITWhisperer 2022-03-02T13:07:00Z https://community.splunk.com/t5/Splunk-Search/Is-there-anyway-to-create-a-file-with-a-list-of-IP-s-that-i-can/m-p/587217#M204524 <P>i saw the lookup tables. i will try to figure them out. never used them before. kinda still learning Splunk.<BR />TY</P> Wed, 02 Mar 2022 13:18:11 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-anyway-to-create-a-file-with-a-list-of-IP-s-that-i-can/m-p/587217#M204524 tazzvon 2022-03-02T13:18:11Z https://community.splunk.com/t5/Splunk-Search/Is-there-anyway-to-create-a-file-with-a-list-of-IP-s-that-i-can/m-p/587232#M204526 <P>Read about "outputlookup" command to dynamically build your lookup from your search (<A href="https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Outputlookup" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Outputlookup</A>).&nbsp;</P><P>Here is a reference on how to use lookup as search filter:&nbsp;<A href="https://community.splunk.com/t5/Alerting/How-to-do-a-filtered-list-out-of-a-lookup-table/m-p/257806" target="_blank">https://community.splunk.com/t5/Alerting/How-to-do-a-filtered-list-out-of-a-lookup-table/m-p/257806</A></P> Wed, 02 Mar 2022 13:58:50 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-anyway-to-create-a-file-with-a-list-of-IP-s-that-i-can/m-p/587232#M204526 somesoni2 2022-03-02T13:58:50Z