Splunk Search

compare a previous result

jmsiegma
Path Finder

I have created a search for my VPN users, when they connect, from where they connect (SRC IP) and geoip that IP to lookup the country, city, state.

What I would like to do now is to be able to store that value, and the next time that user logs in so that I would be able to display their last IP, and Geo location information, so I can build a trend as to if that user is logging in from the same place or not.

Any way to do this?

1 Solution

lguinn2
Legend

You could have your search results output to a csv file and then use that file as a lookup table in the future.

Here is a answer that talks about this idea, although the question is different: Lookup table populating from a saved search

Here is some info from the documentation (but you may need to read a little more about lookups, too):
Use Search Results to Populate a Lookup Table

View solution in original post

lguinn2
Legend

You could have your search results output to a csv file and then use that file as a lookup table in the future.

Here is a answer that talks about this idea, although the question is different: Lookup table populating from a saved search

Here is some info from the documentation (but you may need to read a little more about lookups, too):
Use Search Results to Populate a Lookup Table

Get Updates on the Splunk Community!

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...