Splunk Search

How to search for IP addresses in a lookup that are not found in my events?

Path Finder

I have a lookup which has an IP address column, and I'm trying to find which if the IP addresses from this lookup table DO NOT appear in any of my events.

I've very new to this. I've been trying several things, with no success yet.

Thanks for any replies.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try something like this (assuming ipaddress is the field that appears in your events and ipfield is the field in lookup table)

index=foo sourcetype=bar [| inputlookup your_ip_lookup.csv | table ip_field | rename ip_field as ip_address] | stats count by ip_address | append [| inputlookup your_ip_lookup.csv | table ip_field | rename ip_field as ip_address | eval count=0 ] | stats max(count) as count by ip_address | where count=0

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try something like this (assuming ipaddress is the field that appears in your events and ipfield is the field in lookup table)

index=foo sourcetype=bar [| inputlookup your_ip_lookup.csv | table ip_field | rename ip_field as ip_address] | stats count by ip_address | append [| inputlookup your_ip_lookup.csv | table ip_field | rename ip_field as ip_address | eval count=0 ] | stats max(count) as count by ip_address | where count=0

View solution in original post

0 Karma

Path Finder

Perfect. Thank you!

0 Karma