Getting Data In

Search for all events for IP address within a CSV file

umarfarooq
Explorer

I would like to know how we can search for all events for a list of IP in a CSV file.

0 Karma
1 Solution

somesoni2
Revered Legend

Without much information here, my suggestion would be this:

Search based on a field (assuming each event have a field called IP_Address, adjust per your situation)

index=foo sourcetype=bar   [| inputlookup yourcsvfile.csv | table IP_Address ]

String based search (no fields are extracted, searching IP address in the raw data)

index=foo sourcetype=bar   [| inputlookup yourcsvfile.csv | table IP_Address | rename IP_Address as search ]

View solution in original post

elliotproebstel
Champion

If you have a CSV file called ip.csv with a column called IP in Splunk, you can feed it into a search like this:
index=myindex [ | inputlookup ip.csv | stats values(IP) AS search | format ]

That will turn each IP address from ip.csv into a seach term. So if your CSV file looked like this:

IP
1.2.3.4
2.3.4.5
3.4.5.6

Then the above search would wind up searching for this: index=myindex ("1.2.3.4" OR "2.3.4.5" OR "3.4.5.6")

umarfarooq
Explorer

Thank you very much.

This solved my problem.

0 Karma

somesoni2
Revered Legend

Without much information here, my suggestion would be this:

Search based on a field (assuming each event have a field called IP_Address, adjust per your situation)

index=foo sourcetype=bar   [| inputlookup yourcsvfile.csv | table IP_Address ]

String based search (no fields are extracted, searching IP address in the raw data)

index=foo sourcetype=bar   [| inputlookup yourcsvfile.csv | table IP_Address | rename IP_Address as search ]

umarfarooq
Explorer

Hi.

Sorry for being a bit vague, I'm very new to Splunk and its search language.

I've marking this as a solution.

Thanks for your help.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...