topic Re: Splunk query to filter logs in Splunk Search

Splunk query to filter logs

alexspunkshell — Tue, 09 Mar 2021 16:02:25 GMT

In my search result i am getting AD & Login locations.

Now I want to filter result, if both AD and Login locations are same.

Please help me with splunk query

ITWhisperer — Tue, 09 Mar 2021 09:08:43 GMT

Assuming last two letters are the location you are interested in

| rex field=login_location "(?<logloc>\w\w$)" | rex field=AD_location "(?<adloc>\w\w$)" | where logloc=adloc

alexspunkshell — Tue, 09 Mar 2021 15:17:46 GMT

@ITWhisperer This query also filters if logon & Ad location is empty.

But I need to captured in result if those fields are empty. Could you plz help here.

scelikok — Sat, 13 Mar 2021 07:52:29 GMT

Please try this;

| rex field=login_location "(?<logloc>\w\w$)" | rex field=AD_location "(?<adloc>\w\w$)" | fillnull value="-" adloc logloc | where logloc=adloc