Splunk Search

Grouping Client Ips

Contributor

Hi,

We have different set of clientIPs and we want to group them so that we can either group them by or exclude that group or something like that..Do you have any suggestions whether to create as an events/macros/tags would give more value?

Tags (1)

Builder

If you have all the IP's addresses the best way to proceed would be using automatic lookups and thus creating a new field, then use the values of that field to do the grouping.

If you don't have the full IP addresses and just want to group them depending on the network they belong to, I would use the 'eval' command to create a new field based on whatever rule you need to create the grouping.

Legend

Additionally you could even define net ranges if that's more convenient, and then specify the lookup type to be cidr. Splunk understands cidr notation.

0 Karma

Builder

yes, you just need a lookup like this, and the IP address that are not included there will not get any value in the field 'company', or you could set a default value too

IP,company
IPsample1,xxx
IPsample2,xxx
...
..
IPsample3,yyy
IPsample4,xxx
IPsample5,zzz
..
.
IPsample6,zzz
IPsample7,xxx

0 Karma

Contributor

Hi Thanks for the response. We have some IPs that are white listed. For examle if we have 1000 ips, out of those i know about 100 of them. Say 10 are from xxx company and 50 are from yyy and 40 are from zzz company. So do you think i can still use automatic lookups?

0 Karma