How do you use a lookup file to restrict unwanted IP addresses?

[as0813]

Use case description: I have a set of IP address that I would like to restrict across all requires, saved searches/alert/report/dashboards.

Currently I am using NOT IP IN (ip1, ip2...) condition in searches. But this creates an overhead if I have to make changes like adding a new IP address; I will have to add in multiple places.

Also, please suggest another easier way to implement if there are any that do not require a Splunk instance restart.

[woodcock]

You need to create a tag called something like restricted for each ip=value pair. Then when you need to add or remove an ip, you just change the single tag setting. Now, to add it to all searches, you can either modify each search to add NOT tag=restricted (which is better) OR, if you are really in a hurry to get this done, you can add it to Settings -> Access controls -> Roles -> edit the one that applies to your users or create a new one -> Restrict search terms and add it there.

[ddrillic]

Instead of the NOT IP IN (ip1, ip2...) construct, you can use something like index=<your index> NOT [ | inputlookup unwantedIPs.csv ]. It should work if you have a common field in the index and in the inputlookup, such as IPaddress.

For this point on you can maintain the lookup table and no Splunk restart is needed.

[Vijeta · Accepted solution]

You can create in eventtype from Settings->Eventtype and assign it equal to NOT IP IN(Ip1,IP2,....).

Later in your searches and dashboards you can use eventtype rather than the NOT IP in,this way you need to update only at one place i.e. your eventtype definition.

For adding eventtype toyour search you can refer this thread -
https://answers.splunk.com/answers/302235/how-do-i-add-an-eventtype-to-my-search.html