Create a list

[rootadmin]

Hi

Im very new to splunk (first day using it)

Is it possible to create a list of known mac addresses so that i can perform a search

so at the moment im searching for new wireless client associations against the router, i would like to put existing wireless clients into a list of known mac addresses to include a not statement to account for known mac addresses.

have this working currently by explicitly mentioning each mac address in the not statement

[MHibbin]

You can do this using a lookup table (CSV) stored on the host server.

http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsfromexternaldatasources

You can then use a combination of an inputlookup command and subsearch in your search to filter these out.

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Inputlookup
http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutsubsearches

So (if my memory is correct - not done this is a little while), you could do something like:

<yourBaseSearch> NOT [|inputlookup <lookupFile> | fields + mac]

Hope this helps,

MHibbin