Splunk Search

How to define a constant variable for internal IP addresses for all apps and searching?

jcrochon
Explorer

I’m looking for a way to define a constant to use as a variable when searching.

Such defined as:

define LocalIPs = 10.10.0.0/16, 192.168.0.0/16, 128.131.0.0/16

Search as:

search src_ip=LocalIPs | top src_ip,dest_ip
0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

save your list in a csv lookup in a column named src_ip and list your ip's
after that in your search you can then use:

 [|inputlookup local_ips.csv] | top src_ip,dest_ip

this will translate to

(src_ip=10.10.0.0/16 OR src_ip=192.168.0.0/16 OR src_ip=128.131.0.0/16) | top src_ip,dest_ip
------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

diogofgm
SplunkTrust
SplunkTrust

save your list in a csv lookup in a column named src_ip and list your ip's
after that in your search you can then use:

 [|inputlookup local_ips.csv] | top src_ip,dest_ip

this will translate to

(src_ip=10.10.0.0/16 OR src_ip=192.168.0.0/16 OR src_ip=128.131.0.0/16) | top src_ip,dest_ip
------------
Hope I was able to help you. If so, some karma would be appreciated.

jcrochon
Explorer

Is there an option in the interface to define this?

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Just create your csv and upload it via splunk lookup menu.
Also, you can you the app lookup editor to create it and maintain it.

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

jcrochon
Explorer

P. S. What if I wanted to switch from local src_ip to dest_ip?

Would this work:
dest_ip=[| inputlookup local_ips.csv]

0 Karma

diogofgm
SplunkTrust
SplunkTrust

[|inputlookup local_ips.csv | rename src_ip AS dest_ip] | ...

------------
Hope I was able to help you. If so, some karma would be appreciated.

jcrochon
Explorer

Thanks again for all the help.

0 Karma

jcrochon
Explorer

Thank you.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...