Actually i made lookup with the list of ip address in .csv file. I want to write a query if there is traffic from the ip address which i had given in the lookups.
Please help me woth the query. i have the Web datamodel as well
Thanks & Regards,
Umesh Chandra Reddy
You don't say where the traffic analysis comes from ... Any index, source, sourcetype ?
Do you want to analyze the activity toward the Splunk Web server itself ? If so, you would start looking in
index=_internal source=splunkd_access.log sourcetype=splunkd_ui_access clientip=*
Here the clientip is the field that tells you about the incoming connection.
If you want to compare it with the lookup you can then add this :
... | LOOKUP <lookup.csv/lookup definition> clientip OUTPUTNEW clientip AS knownIP
If the ip address is in the csv, then it will be shown in the knownIP field.
If it is unknown, the knownIP field will be inexistent.
After what you can filter the results based on the existence of that knownIP field, with:
| where isnull(knownIP)
| where isnotnull(knownIP)