Adding IP's to a exposed text file

arunkuriakose · ‎05-03-2021

Hi Team

I want to collect source ip from an alert triggered /search ran and then add that to a .txt file exposed on a separate server.(https://urlofserver/ipfile.txt)

What is the best way to achieve this

aasabatini · ‎05-03-2021

Hi @arunkuriakose

you can add on your alert action an sh script to save all result ip on your txt file.

https://docs.splunk.com/Documentation/Splunk/8.1.3/AdvancedDev/CustomAlertScript

or if in your case works fine a csv file you can add on your alert search the outputlookup comand to save the results in a new csv file.

https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Outputlookup

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

Adding IP's to a exposed text file

alert action

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

Adding IP's to a exposed text file

alert action

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...