topic How to pipe REX sequence related to host network? in Splunk Search

How to pipe REX sequence related to host network?

null0 — Fri, 22 Jun 2018 17:36:44 GMT

Hello,
this threat to find a solution to this problem: i have many network as

(host=10.29.4.*)

not /24 but subnetted with

|rex field=host "10.29.4.(?\d{1,3})" | where range>=48 AND range<=63 ->/27

so.. how to concatenate, eg.:

(host=10.29.4.*) OR (host=10.29.10.*)
|rex field=host  "10\.29\.4\.(?<range>\d{1,3})" | where range>=48 AND range<=63
|rex field=host  "10\.29\.10\.(?<range>\d{1,3})" | where range>=0 AND range<=63

Many thanks

Re: How to pipe REX sequence related to host network?

kmorris_splunk — Fri, 22 Jun 2018 18:38:38 GMT

Are you trying to get the field range to be a combined list of IPs from both rex statements?

Re: How to pipe REX sequence related to host network?

null0 — Fri, 22 Jun 2018 18:49:54 GMT

hi kmorris, nope, no combined list in field range.
i sincerly dont know how to do it.. do you have any hint?

bear i mind that i've totally 23 |rex filters related to as many networks

Re: How to pipe REX sequence related to host network?

kmorris_splunk — Fri, 22 Jun 2018 18:50:43 GMT

I meant to say a list of all of the range values, not IPs.

Re: How to pipe REX sequence related to host network?

null0 — Fri, 22 Jun 2018 19:00:13 GMT

i think it's hard because "range" value is a kind of consequence of network-fields that comes before (eg: 10.29.10.xxxx)

i'm not really skilled, sorry 😉

Re: How to pipe REX sequence related to host network?

kmorris_splunk — Fri, 22 Jun 2018 19:03:57 GMT

Try this:

(host=10.29.4.*) OR (host=10.29.10.*) 
| rex field=host "10\.29\.4\.(?<range_10_29_4>\d{1,3})" 
| rex field=host "10\.29\.10\.(?<range_10_29_10>\d{1,3})" 
| where (range_10_29_4 >= 48 AND range_10_29_4 <= 63) OR (range_10_29_10 >= 0 AND range_10_29_10 <= 63) 
| eval range=coalesce(range_10_29_4, range_10_29_10)