Splunk Search

Splunk Query Exclude Question

johann2017
Explorer

I am building a search query and trying to find the correct syntax to exclude specific combinations of source and destination IP addresses. For instance, in the search results I want to exclude results only between specific source and destination IPs. So if there is a lot of traffic happening between 192.168.1.5 and 192.168.1.20 I want to only exclude traffic between those two IPs, but still see traffic between 192.168.1.5 and other IPs.

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

cidrmatch is what your looking for

| eval IP_Range = if(cidrmatch("192.168.1.5/25",ip), "local", "not local"))

http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/ConditionalFunctions

0 Karma

skoelpin
SplunkTrust
SplunkTrust

@johann2017 did this work for you?

0 Karma

johann2017
Explorer

Hello Skoelpin. I don't think cidrmatch is what I need?

0 Karma

tiagofbmm
Influencer

Hey

Imagine you want to exclude some combinations you have in a lookup, you could use:

yoursearch | NOT ( [ | inputlookup ipscombination | return 1000 source ,dest | rex field="search" mode=sed "s/OR/AND/g" ] 

That would exclude the combinations of source/dest you have in a lookup.

0 Karma

johann2017
Explorer

Hey Tiago - where exactly in the query do I place the IP addresses? Does this work for only 2 IPs? Will it work for more than 2?

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...