Splunk Search

Predefined Group

balcv
Contributor

What is the best way to define a "group" of ip subnets called server_subnet then use that in searches.

I have about 19 subnets used to host our server fleet and I would like to define these subnets and assign a name such as server_subnets so I can then write a search that references that name. For example

index="*" src_ip="server_subnets" | stats count by host

OR

index="*" dest_ip!="server_subnets"

Thanks

0 Karma
1 Solution

renjith_nair
Legend

@balcv ,

You may use tags or eventtypes to group fields/values

Most of the options are detailed in the Classify and group similar events

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@balcv ,

You may use tags or eventtypes to group fields/values

Most of the options are detailed in the Classify and group similar events

---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...