Splunk Enterprise Security

splunk search query

trojan_81
Path Finder

Hi

suppose I have this IP address 10.5.5.5

I just want to see any information that splunk has on this IP. I'm starting with a wide search.

What would the search query look like? If I simply type this in, it doesn't work: index=* 10.5.5.5
At minimum would that mean I need to specific a field for the IP address?

0 Karma
1 Solution

oscar84x
Contributor

Use quotations marks around it (See below). Also think about the time range you're searching, there might not be results for that ip in your time range.
Also, check out this Search Tutorial for more useful tips: https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchTutorial/WelcometotheSearchTutorial

 index=* "10.5.5.5"

View solution in original post

0 Karma

oscar84x
Contributor

Use quotations marks around it (See below). Also think about the time range you're searching, there might not be results for that ip in your time range.
Also, check out this Search Tutorial for more useful tips: https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchTutorial/WelcometotheSearchTutorial

 index=* "10.5.5.5"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...