Getting Data In

Splunk search using csv file as whitelist for ip addresses

New Member

Is there a way to use a file instead of entering ip's when wanting to exclude ranges of ip's from a search, such as NOT instead of NOT (1.1.1.* OR 1.2.1.* OR 1.1.2.3) I'm trying to exclude known good ip's from a search in order to see possible interesting traffic without having to type them into the search by just updating a file instead.

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

you can list all your IP that you want to white lsit in CSV file then run your search againest that file

eg

tag=traffic NOT [|inputcsv rchiiiwhitelistIP.csv ]

good luck

0 Karma