Splunk Search

If I have a search that returns a list of IP addresses, what would be the syntax to check if IPs in a second list do not appear in this result set?

alexl1
Path Finder

hi,

Say I have a search that returns a list of IP addresses. What is the syntax to check if IPs in a second list do not appear in this result set?

Tags (2)
0 Karma

yannK
Splunk Employee
Splunk Employee

First, if you have a field that contains several IPs you can split the events
- you may want to define a multivalue field (see makemv)
- and split each event in one event per IP (see mvexpand) .
see http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Parsemultivaluefields

Second, to do the matching between the results and the second list.
You can use several methods like :
- use JOIN command (only if you have less than 10000 lines in the list)
- use a lookup, and maybe add a command to mark the matching/non matching events.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...