Splunk Search

compare a previous result

jmsiegma
Path Finder

I have created a search for my VPN users, when they connect, from where they connect (SRC IP) and geoip that IP to lookup the country, city, state.

What I would like to do now is to be able to store that value, and the next time that user logs in so that I would be able to display their last IP, and Geo location information, so I can build a trend as to if that user is logging in from the same place or not.

Any way to do this?

1 Solution

lguinn2
Legend

You could have your search results output to a csv file and then use that file as a lookup table in the future.

Here is a answer that talks about this idea, although the question is different: Lookup table populating from a saved search

Here is some info from the documentation (but you may need to read a little more about lookups, too):
Use Search Results to Populate a Lookup Table

View solution in original post

lguinn2
Legend

You could have your search results output to a csv file and then use that file as a lookup table in the future.

Here is a answer that talks about this idea, although the question is different: Lookup table populating from a saved search

Here is some info from the documentation (but you may need to read a little more about lookups, too):
Use Search Results to Populate a Lookup Table

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...