Hi,
I want to exclude some IP addresses which are about over 100 in my search.
Seems silly to type NOT NOT NOT.. 100+ times.
source="dbmon-tail://netmanias/splunk_ads_click" NOT "61.247.204.36" NOT "61.247.204.38" NOT "61.247.204.37" NOT "61.247.204.39" NOT "61.247.204.35......"
Is there any good idea?
yes! use a combination of a lookup file and a subsearch.
Put all your IP addresses into CSV file, called "ipAdd.csv" for example with the following contents:
match,ip
1,61.247.204.36
1,61.247.204.38
1,61.247.204.37
1,61.247.204.39
1,61.247.204.35
....
Create a transforms.conf
file with the following stanza:
[ipAdd]
filename = ipAdd.csv
Check that Splunk likes this configuration/format by putting the following into a search box (note that the "|
" should be the first character):
| inputlookup ipAdd
Assuming this returns the contents of the file, you can construct your search as follows:
source="dbmon-tail://netmanias/splunk_ads_click" NOT [|inputlookup ipAdd | rename ip AS query | fields query]
Ref:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Search/Aboutsubsearches
http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsfromexternaldatasources
http://docs.splunk.com/Documentation/Splunk/4.3.4/User/HowSubsearchesWork
Hope this helps,
If the IP addresses are in a specific range you could use the CIDR notation like this:
source="dbmon-tail://netmanias/splunk_ads_click" NOT 61.247.204.0/24
yes! use a combination of a lookup file and a subsearch.
Put all your IP addresses into CSV file, called "ipAdd.csv" for example with the following contents:
match,ip
1,61.247.204.36
1,61.247.204.38
1,61.247.204.37
1,61.247.204.39
1,61.247.204.35
....
Create a transforms.conf
file with the following stanza:
[ipAdd]
filename = ipAdd.csv
Check that Splunk likes this configuration/format by putting the following into a search box (note that the "|
" should be the first character):
| inputlookup ipAdd
Assuming this returns the contents of the file, you can construct your search as follows:
source="dbmon-tail://netmanias/splunk_ads_click" NOT [|inputlookup ipAdd | rename ip AS query | fields query]
Ref:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Search/Aboutsubsearches
http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsfromexternaldatasources
http://docs.splunk.com/Documentation/Splunk/4.3.4/User/HowSubsearchesWork
Hope this helps,
Thank you so much!! I solved it!!