We are using Splunk es. We started porting list into the threat intel feeds. Our analyst wants to remove a single IP from this list and not suppress them. Is there a way of doing this without having to |outputlookup tabling over ip_intel?
Anything will help.
That is only way if you don't have expiration setup and cannot wait for it to expire out.
| inputlookup ip_intel where NOT ip="x.x.x.x" | outputlookup ip_intel
