Splunk Search

How do I remove certain IP addresses with only 3 octets in the Search app?

luongg
Explorer

I have a file that contains a list of IP addresses (Some that are full IPv4 and some that only have an IP with the first 3 octets). I was able to upload the file into Splunk as a lookup file and search for it to display it on Splunk Web. Assuming that I have one column with a mixture of IP addresses that are either IPv4 (Ex: 10.4.123.11) or IPv4 with only the first 3 octets showing (Ex: 10.1.236). Is there an easy way to remove any IP address entries that only have the 3 octets?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Not sure if I get the requirement completely. But give this a try.

| inputlookup yourlookup.csv | regex yourIpfield!="^\d+\.\d+\.\d+$"

View solution in original post

0 Karma

Raschko
Communicator

You could use a regex on the IP field, like:

your search | regex ipfield="^(?!\d{1,3}\.\d{1,3}\.\d{1,3}$)"
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Not sure if I get the requirement completely. But give this a try.

| inputlookup yourlookup.csv | regex yourIpfield!="^\d+\.\d+\.\d+$"
0 Karma

luongg
Explorer

This worked out perfectly. Thanks for the help!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...