Splunk Search

Ignore List in a Macro

albyva
Communicator

If you create a search to watch network traffic and you wish to ignore a listing of /32 Destination IPs, would you create a macro of those IPs (ie: dest_ip=10.0.0.1/32) and then use
the NOT function in the search? For example:

Macro = whitelist
Search = index=generic NOT whitelist

Would this setup filter out all the IPs listed in the macro?

0 Karma

lukejadamec
Super Champion

Yes. But to call the macro you need backtacks NOT `whitelist`.

albyva
Communicator

Thanks. I actually do have the backtacks, but for some reason they aren't displaying in the Question. When I go to edit it, they appear and then disappear when saved. Weird. 🙂

AnyHoo... Thanks for the confirmation.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...