Splunk Search

How to define a constant variable for internal IP addresses for all apps and searching?

jcrochon
Explorer

I’m looking for a way to define a constant to use as a variable when searching.

Such defined as:

define LocalIPs = 10.10.0.0/16, 192.168.0.0/16, 128.131.0.0/16

Search as:

search src_ip=LocalIPs | top src_ip,dest_ip
0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

save your list in a csv lookup in a column named src_ip and list your ip's
after that in your search you can then use:

 [|inputlookup local_ips.csv] | top src_ip,dest_ip

this will translate to

(src_ip=10.10.0.0/16 OR src_ip=192.168.0.0/16 OR src_ip=128.131.0.0/16) | top src_ip,dest_ip
------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

diogofgm
SplunkTrust
SplunkTrust

save your list in a csv lookup in a column named src_ip and list your ip's
after that in your search you can then use:

 [|inputlookup local_ips.csv] | top src_ip,dest_ip

this will translate to

(src_ip=10.10.0.0/16 OR src_ip=192.168.0.0/16 OR src_ip=128.131.0.0/16) | top src_ip,dest_ip
------------
Hope I was able to help you. If so, some karma would be appreciated.

jcrochon
Explorer

Is there an option in the interface to define this?

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Just create your csv and upload it via splunk lookup menu.
Also, you can you the app lookup editor to create it and maintain it.

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

jcrochon
Explorer

P. S. What if I wanted to switch from local src_ip to dest_ip?

Would this work:
dest_ip=[| inputlookup local_ips.csv]

0 Karma

diogofgm
SplunkTrust
SplunkTrust

[|inputlookup local_ips.csv | rename src_ip AS dest_ip] | ...

------------
Hope I was able to help you. If so, some karma would be appreciated.

jcrochon
Explorer

Thanks again for all the help.

0 Karma

jcrochon
Explorer

Thank you.

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...