Getting Data In

Filter out my own source IP Address

Kai191
New Member

I have my search command as source="C:\Users\L30814\Desktop\1713.log" http | top 10 DestinationIP. What is the additional command to add in in order to filter out my own source IP Address??

0 Karma
1 Solution

gfuente
Motivator

Hello

You could try something like:

source="C:\Users\L30814\Desktop\1713.log" http NOT "xxx.xxx.xxx.xxx" |  top 10 DestinationIP

But this would filter any event with that ip adress, not just "source" adresses.

If you have the field extracted you can do it better with this command:

source="C:\Users\L30814\Desktop\1713.log" http AND c_ip!="xxx.xxx.xxx.xxx" |  top 10 DestinationIP

Supposing that you source ip adress is extracted in the field c_ip

Regards

View solution in original post

gfuente
Motivator

Hello

You could try something like:

source="C:\Users\L30814\Desktop\1713.log" http NOT "xxx.xxx.xxx.xxx" |  top 10 DestinationIP

But this would filter any event with that ip adress, not just "source" adresses.

If you have the field extracted you can do it better with this command:

source="C:\Users\L30814\Desktop\1713.log" http AND c_ip!="xxx.xxx.xxx.xxx" |  top 10 DestinationIP

Supposing that you source ip adress is extracted in the field c_ip

Regards

gfuente
Motivator

No problem

You can mark it as "Correct answer" if you think it´s correct. Thanks

0 Karma

Kai191
New Member

Thaks a lot!

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...