splunk SPL help

[nnonm111]

Please help sql when connecting to different IPs is successful.

filed list
ip -> src_ip
access -> success

(filed is You can change it to something comfortable.)

[isoutamo · Accepted solution]

Hi

I'm not sure if I understood your request correct, but maybe this helps you? If not, could you send some events so we could create your query based on those.

index=<your index> access=success
| dedup src_ip

This sample expects that you have field name access there which has values success or something else if connection didn't works.

r. Ismo 

[nnonm111]

If so, to view access success among IPs other than 192.168.10.11

index="my_index" src_ip=192.168.10.11 NOT src_ip access=success

Is it possible to do that?

[isoutamo]

index="my_index" src_ip!="192.168.10.11" access=success