Getting Data In

Global Tokens in Searches

shocko
Contributor

I'm an occasional Splunk Enterprise user so forgive me if this is a noob question or has been answred before:

We use Qualys to scan our systems daily for vunerabilties. As such, on things like web servers it generates a lot of logs entries as it scans endpoints. At times it might crawl a website for example generating a lot of failed requests as it creates ad-hoc GET requests to try and see what to can return from the site.

As such, I have a requirment to build queries that exclude log entries with the scanners IP address therein. The thing is this IP (or rather IPs) are growing as we introduce slave nodes to scan our network.

What I would like to do is the following:

  • have our query creators use a token that is a list of the Qualys scanner IP addresses and use that as an exclusion in their search macros e.g. index=iis | c_ip NOT ($myglobaltoken)

 The thing is though I want this token defined globally by the admin team so we can update the values in it and thus all queries (in different apps etc.) referencing it are updated thus. 

Is this possible?

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

One way to do that is with a macro.  Define a macro with the list of IP addresses in it.  Make sure it is syntactically correct.  Share the macro Globally.  Then users just need to use the macro in their searches.

index=iis | c_ip NOT `myglobaltoken`
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

One way to do that is with a macro.  Define a macro with the list of IP addresses in it.  Make sure it is syntactically correct.  Share the macro Globally.  Then users just need to use the macro in their searches.

index=iis | c_ip NOT `myglobaltoken`
---
If this reply helps you, Karma would be appreciated.

tazzvon
Engager

i know this is and old post but does it still work in 8.2

also if someone could give an example of how to fill out the macro. I am also looking for a way to reference a list of IP's but the macro does not seem to work or i am using it incorrectly

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, it still works in 8.2.

Please post a new question showing what you've tried and the results from those attempts.  Feel free to refer to this question in yours.

---
If this reply helps you, Karma would be appreciated.
0 Karma

shocko
Contributor

Thanks! Not sure why I didn't think of that!? 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...