Splunk Search

Grouping Client Ips

xvxt006
Contributor

Hi,

We have different set of clientIPs and we want to group them so that we can either group them by or exclude that group or something like that..Do you have any suggestions whether to create as an events/macros/tags would give more value?

Tags (1)

asimagu
Builder

If you have all the IP's addresses the best way to proceed would be using automatic lookups and thus creating a new field, then use the values of that field to do the grouping.

If you don't have the full IP addresses and just want to group them depending on the network they belong to, I would use the 'eval' command to create a new field based on whatever rule you need to create the grouping.

Ayn
Legend

Additionally you could even define net ranges if that's more convenient, and then specify the lookup type to be cidr. Splunk understands cidr notation.

0 Karma

asimagu
Builder

yes, you just need a lookup like this, and the IP address that are not included there will not get any value in the field 'company', or you could set a default value too

IP,company
IP_sample_1,xxx
IP_sample_2,xxx
...
..
IP_sample_3,yyy
IP_sample_4,xxx
IP_sample_5,zzz
..
.
IP_sample_6,zzz
IP_sample_7,xxx

0 Karma

xvxt006
Contributor

Hi Thanks for the response. We have some IPs that are white listed. For examle if we have 1000 ips, out of those i know about 100 of them. Say 10 are from xxx company and 50 are from yyy and 40 are from zzz company. So do you think i can still use automatic lookups?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...