Getting Data In

How to search lookups to find an IP address which is forgotten?

10061987
Engager

Hi all,

I created a lookup 6 months ago and now i have hundreds of lookup and i forgot what was it's name. I am looking for an IP address in which lookup it is but i couldn't find a way to do this. I want to find out which lookup an IP address is in.

Any help would be appreciated!

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

If you have console access to your SH, you might do it with (assuming that you're looking for 1.2.3.4 and your Splunk is installed in default place):

find /opt/splunk -type f -path \*/lookups/\* -print0 | xargs -0 grep '1\.2\.3\.4'

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...