Splunk Search

How do I remove certain IP addresses with only 3 octets in the Search app?

Explorer

I have a file that contains a list of IP addresses (Some that are full IPv4 and some that only have an IP with the first 3 octets). I was able to upload the file into Splunk as a lookup file and search for it to display it on Splunk Web. Assuming that I have one column with a mixture of IP addresses that are either IPv4 (Ex: 10.4.123.11) or IPv4 with only the first 3 octets showing (Ex: 10.1.236). Is there an easy way to remove any IP address entries that only have the 3 octets?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Not sure if I get the requirement completely. But give this a try.

| inputlookup yourlookup.csv | regex yourIpfield!="^\d+\.\d+\.\d+$"

View solution in original post

0 Karma

Communicator

You could use a regex on the IP field, like:

your search | regex ipfield="^(?!\d{1,3}\.\d{1,3}\.\d{1,3}$)"
0 Karma

SplunkTrust
SplunkTrust

Not sure if I get the requirement completely. But give this a try.

| inputlookup yourlookup.csv | regex yourIpfield!="^\d+\.\d+\.\d+$"

View solution in original post

0 Karma

Explorer

This worked out perfectly. Thanks for the help!

0 Karma