what was the search that was used in splunk to look for failed log on attempts from windows logs? I'm new to splunk and need to get this info from my network. ... View more

From other comments, my guess as to the best fit for this use case would be eventtypes, macros or tags. Eventtypes ad macros can be created from a search. In your case, you could create an eventtype like [MySpecialIPAddresses] index=mynetworkindex ip_addr="10.0.1.0/24" OR ip_addr="10.1.1.0/24" OR ... Finish that trailing set of dots, of course. If you put that in eventtypes.conf, you could then search like eventtype=MySpecialIPAddresses And that will get all the events that the preceding "eventtype" search matches. A Macro could be created with nearly the exact same search string. To you use, you would use the macro name in backticks where you would normally have used the search. So if you created a macro named myIPAddresses just like the above eventtype's search, you could call that like so in a regular search: `myIPAddresses` | ... do more stuff ... I will leave tags as an exercise for the user, but since you can't use an actual "regular" search in a tag definition, you'll probably want an eventtype anyway. ... View more