I'm an occasional Splunk Enterprise user so forgive me if this is a noob question or has been answred before:
We use Qualys to scan our systems daily for vunerabilties. As such, on things like web servers it generates a lot of logs entries as it scans endpoints. At times it might crawl a website for example generating a lot of failed requests as it creates ad-hoc GET requests to try and see what to can return from the site.
As such, I have a requirment to build queries that exclude log entries with the scanners IP address therein. The thing is this IP (or rather IPs) are growing as we introduce slave nodes to scan our network.
What I would like to do is the following:
- have our query creators use a token that is a list of the Qualys scanner IP addresses and use that as an exclusion in their search macros e.g. index=iis | c_ip NOT ($myglobaltoken)
The thing is though I want this token defined globally by the admin team so we can update the values in it and thus all queries (in different apps etc.) referencing it are updated thus.
Is this possible?
