Splunk Search

Splunk Query Exclude Question

johann2017
Explorer

I am building a search query and trying to find the correct syntax to exclude specific combinations of source and destination IP addresses. For instance, in the search results I want to exclude results only between specific source and destination IPs. So if there is a lot of traffic happening between 192.168.1.5 and 192.168.1.20 I want to only exclude traffic between those two IPs, but still see traffic between 192.168.1.5 and other IPs.

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

cidrmatch is what your looking for

| eval IP_Range = if(cidrmatch("192.168.1.5/25",ip), "local", "not local"))

http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/ConditionalFunctions

0 Karma

skoelpin
SplunkTrust
SplunkTrust

@johann2017 did this work for you?

0 Karma

johann2017
Explorer

Hello Skoelpin. I don't think cidrmatch is what I need?

0 Karma

tiagofbmm
Influencer

Hey

Imagine you want to exclude some combinations you have in a lookup, you could use:

yoursearch | NOT ( [ | inputlookup ipscombination | return 1000 source ,dest | rex field="search" mode=sed "s/OR/AND/g" ] 

That would exclude the combinations of source/dest you have in a lookup.

0 Karma

johann2017
Explorer

Hey Tiago - where exactly in the query do I place the IP addresses? Does this work for only 2 IPs? Will it work for more than 2?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...