Is it possible to reference a list in a search?

Follow

Garrett Hickey

• October 29, 2015 17:34

I have a few alerts I would like to run that would exclude any data in a whitelist of distinct IPs. Is there a way to create a list i can reference in the search or will I have to remove them all manually in each query?

1

• 

  Kevin Francis

  • October 29, 2015 17:49

  I think a good way to do this would be via the LOOKUP operator.
  https://service.sumologic.com/help/Default.htm#Lookup_Operator.htm

  You could upload your IP list to a lookup table (via the SAVE operator), then reference this table in any subsequent queries.

  0

  Comment actions Permalink

Please sign in to leave a comment.