Splunk Search

How can I group IP addresses together to exclude them from my searches?

wraithman2222
New Member

Hello,

I'm new to Splunk and I was just wondering: how can I group IP addresses together to exclude them from my searches?

I'm using the src_ip!="xxx.xxx.xxx.xxx" for all of the IPs I want excluded from the search, but it's not even working anymore as the excluded IPs are still showing up in my results for some reason. There must be a more efficient way to do this right?

I know I have to do something with Lookup tables but I'm not too sure where to begin.

Thank you in advance !

Tags (2)
0 Karma

nilbak1
Communicator

Hi @wraithman2222
yes, you are right you can use lookup csv file here to exclude the ips.
First, create and upload the csv file.
Then use your search query as below.

   Search Query NOT[ inputlookup your_lookup.csv]

It should work!.

0 Karma

Vijeta
Influencer

If you are hard coding in your query you can use, else store them in a look up and use it in your query to ignore the IP from lookup using a subsearch

src_ip NOT IN("xxx.xxx.xxx.xxx","xxx.xxx.xxx.xxx","xxx.xxx.xxx.xxx"....)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...