Predefined Group

[balcv]

What is the best way to define a "group" of ip subnets called server_subnet then use that in searches.

I have about 19 subnets used to host our server fleet and I would like to define these subnets and assign a name such as server_subnets so I can then write a search that references that name. For example

index="*" src_ip="server_subnets" | stats count by host

OR

index="*" dest_ip!="server_subnets"

Thanks

[renjith_nair · Accepted solution]

@balcv ,

You may use tags or eventtypes to group fields/values

Most of the options are detailed in the Classify and group similar events