Splunk Search

Given a list of ip addresses, tell me which ones are *not* in splunk

alexl1
Path Finder

hi, is there a way to make a saved report that, given a fixed list of ip addresses, the report tells me which ones do not appear in a splunk search? Thanks

Tags (1)
0 Karma
1 Solution

cramasta
Builder

How I would tackle this is create a single column csv file in var/run/splunk called ip.csv. Give it a header name called IPADDRESS. This should be the fixed list of IP's

Then I would do a search like below(rename ipfieldname with whatever the ip containing fieldname is called in your data and also rename the sourcetype value if you are even searching by a sourcetype)

| inputcsv ip.csv | join type=left IPADDRESS [search sourcetype=somesourcetype | stats count(ipfieldname) AS IPCOUNT by ipfieldname | rename ipfieldname AS IPADDRESS] | search NOT IPCOUNT=*

This will pull in the full list of fixed ips then run a subsearch which gets a count for each unique ip that it finds in your indexed data. it will when join that ip count to the csv list leaving any IP's that dont have a count to be left with a null value for the IPCOUNT field. Then the end of the search it looks for any IPCOUNT that dont have a value which means it was not seen in the data.

There is probably a better way to do it but that's how off the top of my head i would do it.

View solution in original post

cramasta
Builder

How I would tackle this is create a single column csv file in var/run/splunk called ip.csv. Give it a header name called IPADDRESS. This should be the fixed list of IP's

Then I would do a search like below(rename ipfieldname with whatever the ip containing fieldname is called in your data and also rename the sourcetype value if you are even searching by a sourcetype)

| inputcsv ip.csv | join type=left IPADDRESS [search sourcetype=somesourcetype | stats count(ipfieldname) AS IPCOUNT by ipfieldname | rename ipfieldname AS IPADDRESS] | search NOT IPCOUNT=*

This will pull in the full list of fixed ips then run a subsearch which gets a count for each unique ip that it finds in your indexed data. it will when join that ip count to the csv list leaving any IP's that dont have a count to be left with a null value for the IPCOUNT field. Then the end of the search it looks for any IPCOUNT that dont have a value which means it was not seen in the data.

There is probably a better way to do it but that's how off the top of my head i would do it.

alexl1
Path Finder

yep! 🙂 thx

0 Karma

araitz
Splunk Employee
Splunk Employee

Do you mean that given the list foo,bar,fiz,baz, if the results only have foo and bar, you want the report to show you fiz and baz?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...