Splunk Search

How can I group IP addresses together to exclude them from my searches?

wraithman2222
New Member

Hello,

I'm new to Splunk and I was just wondering: how can I group IP addresses together to exclude them from my searches?

I'm using the src_ip!="xxx.xxx.xxx.xxx" for all of the IPs I want excluded from the search, but it's not even working anymore as the excluded IPs are still showing up in my results for some reason. There must be a more efficient way to do this right?

I know I have to do something with Lookup tables but I'm not too sure where to begin.

Thank you in advance !

Tags (2)
0 Karma

nilbak1
Communicator

Hi @wraithman2222
yes, you are right you can use lookup csv file here to exclude the ips.
First, create and upload the csv file.
Then use your search query as below.

   Search Query NOT[ inputlookup your_lookup.csv]

It should work!.

0 Karma

Vijeta
Influencer

If you are hard coding in your query you can use, else store them in a look up and use it in your query to ignore the IP from lookup using a subsearch

src_ip NOT IN("xxx.xxx.xxx.xxx","xxx.xxx.xxx.xxx","xxx.xxx.xxx.xxx"....)

0 Karma
Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...