Splunk Search

How to filter specfic result

alexspunkshell
Contributor

In my search result, I have the "Description" field.
The Description field contains both texts and 2 IP details.
I want to check both IPs with my lookup table.
If the IPs are not present in the lookup then I need the result.  If the IPs are present in my lookup table then I want to filter the result.

 

Kindly help here.

alexspunkshell_0-1628093699803.png

 

Labels (4)
0 Karma
1 Solution

manjunathmeti
Champion

hi @alexspunkshell
Use rex to extract IPs and lookup IPs in the lookup table.

| rex field=Description max_match=0 "(?<IP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" 
| lookup lookup_table lookup_table_IP_field AS IP OUTPUT lookup_table_IP_field as new_field
| where mvcount(IP)=mvcount(new_field)

 

If this reply helps you, a like would be appreciated.

View solution in original post

manjunathmeti
Champion

hi @alexspunkshell
Use rex to extract IPs and lookup IPs in the lookup table.

| rex field=Description max_match=0 "(?<IP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" 
| lookup lookup_table lookup_table_IP_field AS IP OUTPUT lookup_table_IP_field as new_field
| where mvcount(IP)=mvcount(new_field)

 

If this reply helps you, a like would be appreciated.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...