Splunk Search

How to search list of IPs to check if they're sending data to Splunk?

Mr_Data_2018
New Member

I have a list of IPs and want to check if they are sending data to Splunk but using a single query.
The devices in this list need troubleshooting.
Is there some query I could run referencing this list to get an output of stats or something similar?
Any guidance, please?

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Store you ips in a lookup and extend your search to filter using the stored ips

<your search> [| inputlookup iplist.csv | fields ip | format]
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...