Is it possible to reference a list in a search?
I have a few alerts I would like to run that would exclude any data in a whitelist of distinct IPs. Is there a way to create a list i can reference in the search or will I have to remove them all manually in each query?
-
I think a good way to do this would be via the LOOKUP operator.
https://service.sumologic.com/help/Default.htm#Lookup_Operator.htmYou could upload your IP list to a lookup table (via the SAVE operator), then reference this table in any subsequent queries.
Please sign in to leave a comment.
Comments
1 comment