topic Re: Exclude a known IP from results in Splunk Search

Exclude a known IP from results

MattQ — Thu, 25 Apr 2013 17:23:30 GMT

I am returning query results that give a list of IPs on which an event has occurred. I want to create an alert to fire historically on the data if criteria is met HOWEVER I have a known IP address that will always meet the criteria (my IP). I would like to exclude this either from the results and then fire an event on the remaining results or set a custom alert condition to alert on an event EXCEPT if it is from my IP.

This should be simple. Just missing it

Re: Exclude a known IP from results

kristian_kolb — Thu, 25 Apr 2013 17:53:41 GMT

Have you taken a look at the NOT operator? Or the != operator? Both could be used in your search to exclude results otherwise matching your search criteria.

Re: Exclude a known IP from results

MattQ — Thu, 25 Apr 2013 19:48:18 GMT

Normally this would work yes but the way I am manipulating the data I cant seem to make the NOT command fit. Is there a way to get results of A, C, F, G but exclude: F from my table results list?

Re: Exclude a known IP from results

MattQ — Thu, 25 Apr 2013 19:53:19 GMT

I actually did get this to work using NOT. I just needed to be more creative. Thanks

Re: Exclude a known IP from results

chrisprangnell — Fri, 13 May 2016 02:06:19 GMT

can you share your search phrase please im trying to do similar thing.

Re: Exclude a known IP from results

sundareshr — Fri, 13 May 2016 03:40:02 GMT

@chrisprangnell Try this pseudo code

your base search | stats count by ip | search NOT [| inputlookup knowniplist.csv | table ip ]

Re: Exclude a known IP from results

mosman_splunk — Tue, 29 Sep 2020 09:42:08 GMT

you can list all your IP that you want to white lsit in CSV file then run your search againest that file

tag=traffic NOT [|inputcsv kiristian_whitelist_IP.csv ]

good luck