Splunk Search

How to search for IP addresses from a .txt file to see if any of them have appeared in Splunk before?

simeidem
New Member

Hi,

I have a .txt-file with line separated IP addresses, and I want to know if any of those have appeared in Splunk before.

I could manually enter all the IP addresses in search with "OR" between, but that would literally take weeks..

What to do?

Thanks,
Simon

Tags (3)
0 Karma

jeffland
Champion

You could either index the file with splunk and reference it from there, or you could use a lookup. I would recommend you use a lookup, that way you can use the content of the file dynamically (i.e. update the info in it).

Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...