Splunk Search

How to search for IP addresses from a .txt file to see if any of them have appeared in Splunk before?

simeidem
New Member

Hi,

I have a .txt-file with line separated IP addresses, and I want to know if any of those have appeared in Splunk before.

I could manually enter all the IP addresses in search with "OR" between, but that would literally take weeks..

What to do?

Thanks,
Simon

Tags (3)
0 Karma

jeffland
Champion

You could either index the file with splunk and reference it from there, or you could use a lookup. I would recommend you use a lookup, that way you can use the content of the file dynamically (i.e. update the info in it).

Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...