topic Re: how to store a value from rex and reuse this value in another search in Splunk Search

how to store a value from rex and reuse this value in another search

silverem78 — Thu, 27 May 2021 07:27:29 GMT

Dear fellows,

I have two logs and i am looking to do some correlation between them.

In the log1, i am looking for IP_x (ex: 2.2.2.2)associated with IP_1 (1.1.1.1), then reuse the value of IP_x (2.2.2.2) in another search.

When i execute, i got nothing.

index=* sourcetype=log1 [search index=* sourcetype=log2 src_ip="1.1.1.1"
| rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | table src_ip ] src_ip

if i do this, i got the details

index=* sourcetype=log1 2.2.2.2

when i execute manually the search , i got the table with 2.2.2.2

search index=* sourcetype=log2 src_ip="1.1.1.1"
| rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | table src_ip

Any helps will be welcomed

Re: how to store a value from rex and reuse this value in another search

aasabatini — Thu, 27 May 2021 07:41:00 GMT

Hi @silverem78

try this:

index=* sourcetype=log1 [search index=* sourcetype=log2 src_ip="1.1.1.1" | rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | fields src_ip ]

if doesn't works can you run this search and share the result?

search index=* sourcetype=log2 src_ip="1.1.1.1" | rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | table src_ip | fieldformat

Re: how to store a value from rex and reuse this value in another search

silverem78 — Thu, 27 May 2021 07:55:33 GMT

I got an error with:

search index=* sourcetype=log2 src_ip="1.1.1.1" | rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | table src_ip | fieldformat

I got nothing (with no error) :

index=* sourcetype=log1 [search index=* sourcetype=log2 src_ip="1.1.1.1" | rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | fields src_ip ]

it is like "[search index=* sourcetype=log2 src_ip="1.1.1.1"
| rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | fields src_ip ] " doesnt provide value. 2.2.2.2 ...

Re: how to store a value from rex and reuse this value in another search

aasabatini — Thu, 27 May 2021 08:24:51 GMT

Hi @silverem78

sorry for the error try this search and please share the result

index=* sourcetype=log2 src_ip="1.1.1.1" | rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | table src_ip | format

Re: how to store a value from rex and reuse this value in another search

silverem78 — Thu, 27 May 2021 09:04:58 GMT

I got an error.

Re: how to store a value from rex and reuse this value in another search

aasabatini — Thu, 27 May 2021 11:17:13 GMT

Hi @silverem78

Can you share the error?