topic Re: Filtering a Field Extracted with Rex in Splunk Search

Filtering a Field Extracted with Rex

user333 — Wed, 19 Aug 2020 03:07:35 GMT

Hello,

I am having trouble with filtering fields extracted using rex as follows:

rex max_match=0 field=sessions_as_client "(?<SRC>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s--\>\s(?<DST>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):(?<Port>\d+\/[a-zA-Z]+)"| where Port="123/UDP" | lookup dnslookup clientip as DST OUTPUT clienthost as DSTDNS | table Port DST DSTDNS

The field I am extracting looks as follows:

sessions_as_client="1.2.3.4 --> 1.2.3.5:21/TCP (ftp), 1.2.3.4 --> 1.2.3.5:23/TCP (telnet), 1.2.3.4 --> 1.2.3.5:123/UDP (ntp/udp)"

I am getting a table with the 123/UDP events as expected, but I am also getting the other events such as 21/TCP and 23/TCP in the same row as if each match from the rex statement was no longer applying to the search. Any recommendations are appreciated.

Re: Filtering a Field Extracted with Rex

to4kawa — Wed, 19 Aug 2020 03:59:10 GMT

| rex max_match=0 field=sessions_as_client "(?<SRC>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s--\>\s(?<DST>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):(?<Port>\d+\/[a-zA-Z]+)"
| eval tmp=mvzip(SRC,mvzip(DST,Port))
| mvexpand tmp
| eval src=mvindex(split(tmp,","),0) , DST=mvindex(split(tmp,","),1), Port=mvindex(split(tmp,","),2)
| where Port="123/UDP"
| lookup dnslookup clientip as DST OUTPUT clienthost as DSTDNS
| table Port DST DSTDNS

Re: Filtering a Field Extracted with Rex

user333 — Wed, 19 Aug 2020 13:26:13 GMT

This works. Thank you! Wasn't having this problem with stats or dc after the rex, so didn't know mvindex was needed.