Grouping Client Ips

[xvxt006]

Hi,

We have different set of clientIPs and we want to group them so that we can either group them by or exclude that group or something like that..Do you have any suggestions whether to create as an events/macros/tags would give more value?

[asimagu]

If you have all the IP's addresses the best way to proceed would be using automatic lookups and thus creating a new field, then use the values of that field to do the grouping.

If you don't have the full IP addresses and just want to group them depending on the network they belong to, I would use the 'eval' command to create a new field based on whatever rule you need to create the grouping.

[Ayn]

Additionally you could even define net ranges if that's more convenient, and then specify the lookup type to be cidr. Splunk understands cidr notation.

[asimagu]

yes, you just need a lookup like this, and the IP address that are not included there will not get any value in the field 'company', or you could set a default value too

IP,company
IP_sample_1,xxx
IP_sample_2,xxx
...
..
IP_sample_3,yyy
IP_sample_4,xxx
IP_sample_5,zzz
..
.
IP_sample_6,zzz
IP_sample_7,xxx

[xvxt006]

Hi Thanks for the response. We have some IPs that are white listed. For examle if we have 1000 ips, out of those i know about 100 of them. Say 10 are from xxx company and 50 are from yyy and 40 are from zzz company. So do you think i can still use automatic lookups?