Getting Data In

importing IP List

TucoRameriz
Explorer

Sorry in advance to the newbie question but, is there a way to import a list of IP addresses into splunk search query?

For example, I come across a couple of pieces of malware and identify the call back addresses which could number into the dozens or even hundreds. I would like to be able to import a list with these addresses into Splunk and run those across my Web Logs looking for any activity.

Thanks

Tags (1)

Ayn
Legend

This is a prime example of what you could use a subsearch for. http://docs.splunk.com/Documentation/Splunk/5.0.2/Tutorial/Useasubsearch

Given a lookup table (yourlookuptable) with a list of ip's (field ip), you could do

[| inputlookup yourlookuptable | field ip]

kristian_kolb
Ultra Champion

editing again.....

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...