Splunk Web datamodel whitelisting

burakatabay · ‎03-29-2019

Hello Splunkers,

Trying to fix the Web data models in the CIM and would like to exclude a couple of IP addresses. However, I'm struggling to form a white list for those specific IP addresses.

I'm looking for any guidance links and resources towards creating whitelists, all help is appreciated.
Thanks, and Happy Splunking!

lakshman239 · ‎03-29-2019

Do you want to exclude IP's getting into datamodel? I would suggest to have IPs (e.g. src_ip) in the datamodel and have a category, say (web_blacklist_ips) in your asset data for those IPs. You can then create searches to exclude those Ips using the category.

Splunk Web datamodel whitelisting

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Thanks for the Memories: .conf26 Took Learning to New Heights

Best Practices: Splunk auto adjust pipeline queue

Splunk Auto Ingestion Parallel Pipeline Scaling

Join the Conversation

Splunk Web datamodel whitelisting

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Thanks for the Memories: .conf26 Took Learning to New Heights

Best Practices: Splunk auto adjust pipeline queue

Splunk Auto Ingestion Parallel Pipeline Scaling