Skip to main content
Warning
This app is archived. App archiving documentation
RFC_1918 app icon

RFC_1918

This app adds 2 tags: "dest_ip_is_RFC1918", and "src_ip_is_RFC1918", which are CIM compatible and you can do things like this: | tstats sum(All_Traffic.bytes_out) AS per_source_bytes_out FROM datamodel=Network_Traffic WHERE All_Traffic.dest_port="53" AND NOT (All_Traffic.tag="src_ip_is_RFC1918" AND All_Traffic.tag="dest_ip_is_RFC1918") BY All_Traffic.src_ip _time span=1hBuilt by Gregg Woodcock
splunk product badge
Default Version 24.04.09

April 9, 2024

Compatibility

Splunk Enterprise

Platform Version: 9.4, 9.3, 9.2, 9.1, 9.0

CIM Version: 5.x, 4.x, 3.x

Rating
0
(0)

Log in to rate this app

Support
Archived Add-on

This app adds 2 tags: "dest_ip_is_RFC1918", and "src_ip_is_RFC1918", which are CIM compatible and you can do things like this: | tstats sum(All_Traffic.bytes_out) AS per_source_bytes_out FROM datamodel=Network_Traffic WHERE All_Traffic.dest_port="53" AND NOT (All_Traffic.tag="src_ip_is_RFC1918" AND All_Traffic.tag="dest_ip_is_RFC1918") BY All_Traffic.src_ip _time span=1h