Splunk Search

How to write a search to monitor data center traffic?


Hello All,

I have 2 CIDR lookup files uploaded in Splunk with all necessary configurations done. fFirst Lookup file internal.csv contains data as below,

Region IP

and so on....

While the second lookup file dc.csv contains data as below,

Region IP
Datacenter Europe
Datacenter US

and so on...

I need a search which will show me the data where the source IP is from dc.csv range and destination IP is not from dc.csv and internal.csv CIDR range.

In short, I need a search where I can monitor traffic going outside from Datacenter.

Thanks in advance

0 Karma
1 Solution

0 Karma


Hi, Thanks for the link. This helped me in understanding how lookup works. And was able to write a search to monitor the traffic going outside the datacenter.

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...