Splunk Search

How to write a search to monitor data center traffic?

swapsplunk
Explorer

Hello All,

I have 2 CIDR lookup files uploaded in Splunk with all necessary configurations done. fFirst Lookup file internal.csv contains data as below,

Region IP
EMEA 10.0.0.0/8
APAC 172.15.0.0/16

and so on....

While the second lookup file dc.csv contains data as below,

Region IP
Datacenter Europe 140.0.0.0/18
Datacenter US 50.0.0.0/16

and so on...

I need a search which will show me the data where the source IP is from dc.csv range and destination IP is not from dc.csv and internal.csv CIDR range.

In short, I need a search where I can monitor traffic going outside from Datacenter.

Thanks in advance

0 Karma
1 Solution

sundareshr
Legend
0 Karma

swapsplunk
Explorer

Hi, Thanks for the link. This helped me in understanding how lookup works. And was able to write a search to monitor the traffic going outside the datacenter.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...