How to define a constant variable for internal IP addresses for all apps and searching?

[jcrochon]

I’m looking for a way to define a constant to use as a variable when searching.

Such defined as:

define LocalIPs = 10.10.0.0/16, 192.168.0.0/16, 128.131.0.0/16

Search as:

search src_ip=LocalIPs | top src_ip,dest_ip

[diogofgm · Accepted solution]

save your list in a csv lookup in a column named src_ip and list your ip's
after that in your search you can then use:

 [|inputlookup local_ips.csv] | top src_ip,dest_ip

this will translate to

(src_ip=10.10.0.0/16 OR src_ip=192.168.0.0/16 OR src_ip=128.131.0.0/16) | top src_ip,dest_ip

[jcrochon]

Is there an option in the interface to define this?

[diogofgm]

Just create your csv and upload it via splunk lookup menu.
Also, you can you the app lookup editor to create it and maintain it.

[jcrochon]

P. S. What if I wanted to switch from local src_ip to dest_ip?

Would this work:
dest_ip=[| inputlookup local_ips.csv]

[diogofgm]

[|inputlookup local_ips.csv | rename src_ip AS dest_ip] | ...

[jcrochon]

Thanks again for all the help.

[jcrochon]

Thank you.