Splunk Enterprise Security

How to filter data in an input lookup table?

pbdiggins
Explorer

Hey Splunk People,

 

I'm running a search against a CSV file:

|inputlookup "GSOCdata_230717.csv" | fields source_address, destination_address, protocol_id, destination_port, psrsvd_gc | stats sum(psrsvd_gc) as count by source_address, destination_address, protocol_id, destination_port

 

This builds a table w/ the specified data types contained in the CSV file. Can I filter my data to a smaller output table? I'd like to exclude certain IP addresses from the output of this command. I've tried using a CIDR notation of my address space, but it just chokes.. I've tried .. piping to "eval source_address=172.16.50.0/24" but it doesn't seem to like it..

 

Do you have a suggestion to do this? I worked around this by just building another CSV file with the data filtered to where I want to go, but it seems like this should be solvable in a more elegant way.

 

Thanks,

 

Paul Diggins

Labels (1)
0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

You can pipe | search source_address=172.16.50.0/24 to your search I order to filter the results

------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

pbdiggins
Explorer

Thanks very much. This worked perfectly. I didn't know that you could pipeline another search like that... 

0 Karma

diogofgm
SplunkTrust
SplunkTrust

You can pipe | search source_address=172.16.50.0/24 to your search I order to filter the results

------------
Hope I was able to help you. If so, some karma would be appreciated.

pbdiggins
Explorer

Thanks very much. This worked perfectly. I didn't know that you could pipeline another search like that... 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...