Filter results by IP address

robK123 · ‎11-26-2012

Hi,

I have a search result that shows IP addresses that query a DNS server but how do I filter the search result to only show a particular host IP address.

The search so far just returns all results:

index="DNS-misc" sourcetype="named-query"

Thanks,

martin_mueller · ‎11-26-2012

Assuming the events contain the IP you're looking for and you want to show events containing 1.2.3.4 only you can do this:

index="DNS-misc" sourcetype="named-query" 1.2.3.4

If the filtered IP is extracted to a field, for example "host", you can do this:

index="DNS-misc" sourcetype="named-query" host=1.2.3.4

Filter results by IP address

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Thanks for the Memories: .conf26 Took Learning to New Heights

Best Practices: Splunk auto adjust pipeline queue

Splunk Auto Ingestion Parallel Pipeline Scaling

Join the Conversation

Filter results by IP address

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Thanks for the Memories: .conf26 Took Learning to New Heights

Best Practices: Splunk auto adjust pipeline queue

Splunk Auto Ingestion Parallel Pipeline Scaling