Splunk Search

How to define a constant variable for internal IP addresses for all apps and searching?

jcrochon
Explorer

I’m looking for a way to define a constant to use as a variable when searching.

Such defined as:

define LocalIPs = 10.10.0.0/16, 192.168.0.0/16, 128.131.0.0/16

Search as:

search src_ip=LocalIPs | top src_ip,dest_ip
0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

save your list in a csv lookup in a column named src_ip and list your ip's
after that in your search you can then use:

 [|inputlookup local_ips.csv] | top src_ip,dest_ip

this will translate to

(src_ip=10.10.0.0/16 OR src_ip=192.168.0.0/16 OR src_ip=128.131.0.0/16) | top src_ip,dest_ip
------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

diogofgm
SplunkTrust
SplunkTrust

save your list in a csv lookup in a column named src_ip and list your ip's
after that in your search you can then use:

 [|inputlookup local_ips.csv] | top src_ip,dest_ip

this will translate to

(src_ip=10.10.0.0/16 OR src_ip=192.168.0.0/16 OR src_ip=128.131.0.0/16) | top src_ip,dest_ip
------------
Hope I was able to help you. If so, some karma would be appreciated.

jcrochon
Explorer

Is there an option in the interface to define this?

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Just create your csv and upload it via splunk lookup menu.
Also, you can you the app lookup editor to create it and maintain it.

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

jcrochon
Explorer

P. S. What if I wanted to switch from local src_ip to dest_ip?

Would this work:
dest_ip=[| inputlookup local_ips.csv]

0 Karma

diogofgm
SplunkTrust
SplunkTrust

[|inputlookup local_ips.csv | rename src_ip AS dest_ip] | ...

------------
Hope I was able to help you. If so, some karma would be appreciated.

jcrochon
Explorer

Thanks again for all the help.

0 Karma

jcrochon
Explorer

Thank you.

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...