List of IP Excludes

[daniel333]

All,

I have a list of IP addresses which is about 40 long I don't want to include in my search. Seems silly to type NOT NOT NOT NOT 40+ times. Is there a way for me to place an array of ipaddresses and use a single NOT ?

[gkanapathy]

Yes, use a subsearch that loads a lookup csv file:

sourcetype=things NOT [ inputlookup iplist.csv | fields ip_addr ]

The iplist.csv lookup file should contain a column called ip_addr. if the field name in your sourcetype does not match the column name in the lookup file, you can use the rename command to rename the field.

[martin_mueller]

Going back to laws of boolean artihmetics, not X and not Y is the same as not (X or Y) - if you just want to cut down the number of nots you can use this.

Another solution would be to tag your IPs and exclude that one tag.