Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Grouping Client Ips
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Grouping Client Ips
Hi,
We have different set of clientIPs and we want to group them so that we can either group them by or exclude that group or something like that..Do you have any suggestions whether to create as an events/macros/tags would give more value?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you have all the IP's addresses the best way to proceed would be using automatic lookups and thus creating a new field, then use the values of that field to do the grouping.
If you don't have the full IP addresses and just want to group them depending on the network they belong to, I would use the 'eval' command to create a new field based on whatever rule you need to create the grouping.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Additionally you could even define net ranges if that's more convenient, and then specify the lookup type to be cidr. Splunk understands cidr notation.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes, you just need a lookup like this, and the IP address that are not included there will not get any value in the field 'company', or you could set a default value too
IP,company
IP_sample_1,xxx
IP_sample_2,xxx
...
..
IP_sample_3,yyy
IP_sample_4,xxx
IP_sample_5,zzz
..
.
IP_sample_6,zzz
IP_sample_7,xxx
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Thanks for the response. We have some IPs that are white listed. For examle if we have 1000 ips, out of those i know about 100 of them. Say 10 are from xxx company and 50 are from yyy and 40 are from zzz company. So do you think i can still use automatic lookups?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
SplunkTrust Application Period is Officially OPEN!
