Splunk Enterprise Security

splunk search query

trojan_81
Path Finder

Hi

suppose I have this IP address 10.5.5.5

I just want to see any information that splunk has on this IP. I'm starting with a wide search.

What would the search query look like? If I simply type this in, it doesn't work: index=* 10.5.5.5
At minimum would that mean I need to specific a field for the IP address?

0 Karma
1 Solution

oscar84x
Contributor

Use quotations marks around it (See below). Also think about the time range you're searching, there might not be results for that ip in your time range.
Also, check out this Search Tutorial for more useful tips: https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchTutorial/WelcometotheSearchTutorial

 index=* "10.5.5.5"

View solution in original post

0 Karma

oscar84x
Contributor

Use quotations marks around it (See below). Also think about the time range you're searching, there might not be results for that ip in your time range.
Also, check out this Search Tutorial for more useful tips: https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchTutorial/WelcometotheSearchTutorial

 index=* "10.5.5.5"

View solution in original post

0 Karma