Splunk Search

Compare output of a search to a lookup values

gl_splunkuser
Path Finder

Hello everyone, 

I am trying to compare a list of IPs from a lookup with a output from a search field, and instated of do this, 

| search ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16 ...)

I want to have a lookup with the ips ranges and exclude from the results  the ip that matchs with the lookup.

My lookup is like:

ips

13.64.0.0/11
13.96.0.0/13
13.104.0.0/14
....

Really thanks in advance.

 

Labels (3)
Tags (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @gl_splunkuser,

You can use the lookup for search; I assume your lookup name is "ips_lookup" and has a field called "ips". Please update these with the correct ones.

| search NOT 
    [| inputlookup ips_lookup 
    | fields ips 
    | rename ips as dest_ip]

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @gl_splunkuser,

You can use the lookup for search; I assume your lookup name is "ips_lookup" and has a field called "ips". Please update these with the correct ones.

| search NOT 
    [| inputlookup ips_lookup 
    | fields ips 
    | rename ips as dest_ip]

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...