Splunk Search

Is there anyway to create a file with a list of IP's that i can use in the search field?

tazzvon
Engager

is there anyway to create a file with a list of IP's that i can use in the search field? i am trying to search for IP's that are not in this specific list but i don't want to create the list for every search.

For instance if i want to look through zeek conn.log for bad_guy IP's from a predefined list of bad guy IP's.

Thank you for any help.

0 Karma

tazzvon
Engager

i saw the lookup tables. i will try to figure them out. never used them before. kinda still learning Splunk.
TY

0 Karma

somesoni2
Revered Legend

Read about "outputlookup" command to dynamically build your lookup from your search (https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Outputlookup). 

Here is a reference on how to use lookup as search filter: https://community.splunk.com/t5/Alerting/How-to-do-a-filtered-list-out-of-a-lookup-table/m-p/257806

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could consider creating a lookup table with the bad ip addresses, and using that to filter your search

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...