https://community.splunk.com/t5/Splunk-Search/Defining-variables-or-constants/m-p/37727#M8501 <P>Thx will give it a shot!</P> Fri, 27 Apr 2012 01:31:58 GMT tachu 2012-04-27T01:31:58Z https://community.splunk.com/t5/Splunk-Search/Defining-variables-or-constants/m-p/37725#M8499 <P>I would like to be able to have a predefined variable or constant to run queries with by example</P> <P>source="syslog" login ip!=OFFICEIPS</P> <P>where OFFICEIPS is a set of ip's</P> <P>that way it wont require for us to know all ips every time we do a search but just mantain a table or variable every time a new subnet is added </P> Fri, 27 Apr 2012 00:35:09 GMT https://community.splunk.com/t5/Splunk-Search/Defining-variables-or-constants/m-p/37725#M8499 tachu 2012-04-27T00:35:09Z https://community.splunk.com/t5/Splunk-Search/Defining-variables-or-constants/m-p/37726#M8500 <P>You can use a lookup and reference them from a file. </P> <P>Documentation here with an example:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/knowledge/Addfieldsfromexternaldatasources">http://docs.splunk.com/Documentation/Splunk/latest/knowledge/Addfieldsfromexternaldatasources</A></P> <P>Similar question with details here:<BR /> <A href="http://splunk-base.splunk.com/answers/38520/how-to-generate-a-report-for-searching-the-request-from-huge-list-of-ips">http://splunk-base.splunk.com/answers/38520/how-to-generate-a-report-for-searching-the-request-from-huge-list-of-ips</A></P> Fri, 27 Apr 2012 01:12:06 GMT https://community.splunk.com/t5/Splunk-Search/Defining-variables-or-constants/m-p/37726#M8500 sdaniels 2012-04-27T01:12:06Z https://community.splunk.com/t5/Splunk-Search/Defining-variables-or-constants/m-p/37727#M8501 <P>Thx will give it a shot!</P> Fri, 27 Apr 2012 01:31:58 GMT https://community.splunk.com/t5/Splunk-Search/Defining-variables-or-constants/m-p/37727#M8501 tachu 2012-04-27T01:31:58Z